# Manage organizations
URL: https://docs.datarobot.com/en/docs/platform/admin/manage-entities/manage-orgs.html

> How to create an organization if you wish to restrict user access to workers. You can prevent members from sharing the organization's projects to outside users or groups.

# Manage organizations

> [!NOTE] Required permission
> “Can manage users”

Set an organization for users if you wish to restrict access to workers. See the [overview](https://docs.datarobot.com/en/docs/platform/admin/admin-overview.html#what-are-organizations?) for a description of the organization functionality in DataRobot. Some notes on using organizations:

- Users can belong to only one organization at a time; if you add a user to a new organization, they are automatically removed from the existing organization.
- Assigning a parent organization to a group limitsgroupmembership to members of the parent organization (i.e., you are restricted to adding only users who are members of that parent organization).
- You cannot change a group's parent organization once assigned.
- Management of multiple organizations is available only in Self-Managed deployments.

## Create organizations

Follow these steps to create an organization:

1. Expand the profile icon located in the upper right and clickAPP ADMIN > Organizations. The displayed page lists all existing organizations. From here you create and manage organizations.
2. ClickCreate new organization.
3. In the displayed dialog, enter a name and thenumber of workersto assign to the organization.
4. If you want torestrict usersin this organization to sharing projects only with other users and groups within this organization, selectRestrict sharing to organization members.
5. ClickCreate Organization. TheAll Organizationsprofile lists the new organization.
6. Click an organization to see its profile. In the below image, for example, the new ACME3 organization is allocated a maximum of 14 workers and members of the organization can share projects with users and groups outside of the ACME3 organization.

> [!NOTE] Note
> The worker resource allocation ("Workers limit") is independent from your cluster configuration. To avoid worker resource issues, don’t oversubscribe the physical capacity of the cluster.

## Add users to organizations

You can add one or more users to (or remove users from) any defined organization using the Organizations pages. You can add or remove individual users from the [User Profile > Membership](https://docs.datarobot.com/en/docs/platform/admin/manage-entities/manage-users.html#manage-groups-and-organization-membership) page.

1. Open theOrganizationspage and select the organization to which you want to add a user. The profile page for that organization opens.
2. ClickMembersto list all members of that organization.
3. ClickAdd a userand from the displayed dialog, start typing the name of a user to add. As you type, DataRobot shows usernames containing those characters.
4. Select the intended user and repeat for each user you want to add. When done, clickAdd users.

The displayed list shows all members of the organization and information for each, including first name, last name, and status ( [active/inactive](https://docs.datarobot.com/en/docs/platform/admin/manage-entities/manage-users.html#user-accounts-disable) in DataRobot).

## Delete organizations

You can only delete an organization once all the members have been removed. Any projects previously shared with the organization (and therefore, to each user in the organization), are no longer shared with those (ex) members. If needed, re-share projects with individual users.

To delete an organization:

1. Expand the profile icon located in the upper right and clickAPP ADMIN > Manage Organizations. In the displayed list of organizations, check theTotal Memberscolumn for the organization you want to delete to determine whether there are members assigned it. If the organization has members, you must remove them before you can delete the organization.
2. If the organization has members, do the following:
3. When the organization has no members, view theOrganizationspage and do one of the following:
4. In the displayedConfirm Deletewindow, clickDelete organization(orDelete organizationsif shown). Deleted organizations are removed from the list of organizations.

## Configure organization permissions

You can configure permissions and apply them to all users in an existing organization in addition to managing each user individually. This allows for easier tracking and management of permissions for larger organizations.

> [!NOTE] Note
> Note that a user's effective permissions are the union of those granted to their organization, any user groups they are a member of, and permissions granted to the user directly.  A user who is added to an organization obtains all permissions of that organization. A user who is removed from an organization does not maintain any permissions that were granted to them by the organization. However, a user may still have the permissions granted by that organization if a group they belong to also grants those permissions.

1. To configure permissions for an organization, select it from theOrganizationspage and navigate to thePermissionstab.
2. ThePermissionstab displays the premium products, optional products, preview features, and admin settings available for configuration for your organization. Select the desired permissions to grant your organization from the list.
3. When you have finished selecting the desired permissions for your organization, clickSave Changes.

Once saved, all existing users in your organization and those added to it in the future are granted the configured permissions. A user can view their permissions on the Settings page. Hover over a permission to see what group(s) or organization(s) enabled it.

## Configure organization details

### Understand restricted sharing

You can use a "restricted sharing" setting to prevent organization members from sharing projects from the organization to users or groups outside of it. This setting does not prevent users outside the organization from sharing projects to the organization. Users outside of a "restricted sharing" organization can share projects with any members and groups.

After creating an organization, you can change its restricted sharing policy from the organization profile. If you set Restrict sharing to organization members after the organization was created, any project sharing that already exists is not affected; making this change only prevents the ability to start new project sharing with users or groups outside of the organization.

### Set custom app limits

For custom application users, you can specify the time limit for external application re-authentication. If a user accesses the app within the specified time limit, they are taken directly to its landing page and the time limit resets. If a user does not open the app within the specified time limit, they will be prompted to log in before accessing the app.

To manage this limit:

1. Click the system admin icon on the upper toolbar amd selectOrganizations.
2. On the Profile tab, scroll down toCustom app external user session TTL (days).
3. Define the time limit (in days) in the field. The maximum number of days you can enter is 90.
4. Click Save .

### Set execution environment limits

The execution environment limit allows you to control how many custom model environments a user can add to the [Custom Model Workshop](https://docs.datarobot.com/en/docs/classic-ui/mlops/deployment/custom-models/custom-model-workshop/index.html). In addition, the execution environment version limit allows you to control how many versions a user can add to each of those environments. These limits can be:

1. Directly applied to the user: Set in a user's permissions. Overrides the limits set in the group and organization permissions.
2. Inherited from a user group: Set in the permissions of the group a user belongs to. Overrides the limits set in organization permissions.
3. Inherited from an organization: Set in the permissions of the organization a user belongs to.

If the environment or environment version limits are defined for an organization or a group, the users within that organization or group inherit the defined limits. However, a more specific definition of those limits at a lower level takes precedence. For example, an organization may have the environment limits set to 5, a group to 4, and the user to 3; in this scenario, the final limit for the individual user is 3.

For more information on adding custom model execution environments, see the [Custom model environments documentation](https://docs.datarobot.com/en/docs/classic-ui/mlops/deployment/custom-models/custom-model-environments/custom-environments.html).

To manage the execution environment limits in the platform settings:

1. Click your profile avatar (or the default avatar) in the upper-right corner of DataRobot, and then, underAPP ADMIN, clickOrganizations.
2. To configure permissions for an organization, select it from theOrganizationspage and then clickPermissions. ImportantIf you access theMemberstab to set these permissions, you are setting the permissions on an individual user level, not the organization level.
3. On thePermissionstab, clickPlatform, and then clickAdmin Controls.
4. UnderAdmin Controls, set either or both of the following settings:
5. ClickSave changes.

### Set custom model resource allocation

For DataRobot MLOps users, you can determine the [resources allocated for each custom inference model](https://docs.datarobot.com/en/docs/classic-ui/mlops/deployment/custom-models/custom-model-workshop/custom-inf-model.html#manage-custom) within an organization. Configuring these resources facilitates smooth deployment and minimizes potential environment errors in production.

To manage these resources for an organization, navigate to the organization's Profile page and find Custom model resource allocation settings. Configure the fields:

| Resource | Description |
| --- | --- |
| Desired memory | Determines the minimum reserved memory for the Docker container used by the custom inference model. |
| Maximum memory | Determines the maximum amount of memory that may be allocated for a custom inference model. Note that if a model allocates more than the configured maximum memory value, it is evicted by the system. If this occurs during testing, the test is marked as a failure. If this occurs when the model is deployed, the model is automatically launched again by kubernetes. |
| Maximum replicas | Sets the maximum number of replicas executed in parallel to balance workloads when a custom model is running. |

When you have fully configured the resource settings, click Save.

### Set deployment limits

For DataRobot MLOps users, you can determine the [maximum number of active deployments](https://docs.datarobot.com/en/docs/classic-ui/mlops/manage-mlops/deploy-inventory.html#live-inventory-updates) users are allotted within an organization.

To manage these resources for an organization:

1. Navigate to the organization's Profile page and locate Max deployments .
2. In the field, enter the number of active deployments allotted for users in the organization. This number cannot exceed the number listed underPrepaid deployments.

### Set compute instances

You can adjust the maximum compute instances for an organization. If a limit is not specified, the maximum compute instances for an organization is 8.

To manage compute resources:

1. Navigate to the organization's Profile page and locate Max compute for a serverless platform .
2. In the field, enter the number of resources you want to allocate for the selected organization. then, clickSave.

### Organization-wide consent for Microsoft OAuth

This feature allows administrators to grant [tenant-wide consent](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent?pivots=portal#configure-user-consent-in-microsoft-entra-admin-center) for user permissions required by the DataRobot application in Microsoft Entra ID. In Azure, by default, user permissions are not granted to individual user resources, requiring personal user consent when authorizing a [Microsoft OAuth provider](https://learn.microsoft.com/en-us/entra/architecture/auth-oauth2). When enabled, users also no longer receive consent prompts. If the list of required permissions is changed by the DataRobot application, or the administrator account who granted consent is not active anymore, the administrator must grant consent again to provide the necessary permissions for the DataRobot application.

> [!NOTE] Prerequisite
> Before enabling this feature in DataRobot, in Microsoft Entra ID, a Cloud Application Administrator must [grant tenant-wide consent to the DataRobot application](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent?pivots=portal).
> 
> Managed AI Cloud (SaaS) administrators must contact DataRobot Support to enable this feature.

To enable this feature in DataRobot:

**Self-managed:**
A system adminstrator must perform the following steps:

Click the
System admin
icon in the management toolbar and select
Organizations
.
On the
Profile
tab, scroll down to
Grant organization-wide consent for global Microsoft OAuth providers
.
Select the checkbox to enable global authorization for all users in the organization. The resulting window describes next steps.
After closing the window, click
Save
.

Then, an organization administrator must perform the following steps:

Open
User settings > OAuth provider management
.
Click the
Actions menu
next to the OAuth provider you want to authorize and select
Grant user consent on behalf of organization
.
A window appears describing action that must be taken in Azure Entra ID. Click
Grant consent
and then in Azure, an application administrator must enable consent on behalf of your organization for the DataRobot application.

**SaaS:**
> [!NOTE] Note
> Before proceeding, contact DataRobot Support to enable this feature.

An organization administrator must perform the following steps:

Open
User settings > OAuth provider management
.
Click the
Actions menu
next to the OAuth provider you want to authorize and select
Grant consent on behalf of your organization
.
A window appears describing action that must be taken in Azure Entra ID. Click
Grant consent
and then in Azure, an application administrator must enable consent on behalf of your organization for the DataRobot application.

---
