> For the complete documentation index, see [llms.txt](https://docs.e6data.com/query-engine/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.e6data.com/query-engine/get-started/identity-access-setup/organization-setup.md).

# Organization setup

Set up your e6data organization - invite members, assign roles, and enable domain auto-join.

An **organization** (tenant) is created when the first user signs up; that user becomes its Admin. This page covers adding members to your organization, choosing their roles, and letting people join automatically by email domain. You need the **Invite users** permission (included in the Admin and Manager roles); role management requires **Manage roles**.

Member management lives under **Access Control**, which has tabs for **Users**, **Roles**, **Groups**, and service-account tokens.

## Invite a member

1. Go to **Access Control → Users** and select **Invite**.
2. Enter the person's email address and select **Send Invite**.

The person receives an email with a login link; when they log in and verify their email, they join your organization. New members start with the **Viewer** role - change it with **Manage roles** on their row. (If your email service isn't configured, the member is still granted access - share the login link directly.)

{% hint style="info" %}
If SSO is enabled, manual invitations are turned off - members are created automatically on first sign-in through your identity provider. See [SSO overview](/query-engine/get-started/identity-access-setup/sso-overview.md).
{% endhint %}

## Roles

e6data ships three built-in roles; assign one or more per member:

| Role        | Typical use                                                                        |
| ----------- | ---------------------------------------------------------------------------------- |
| **Admin**   | Organization owners - manage everything, including members, roles, and settings    |
| **Manager** | Team leads - manage workspaces, invite members, manage groups and service accounts |
| **Viewer**  | Read-only access                                                                   |

Invited members (and those who join via auto-join) start as **Viewer**. See [Roles and permissions](/query-engine/guides/security/identity-and-rbac/roles-and-permissions.md) for the full breakdown.

## Manage pending invitations

A person you've invited who hasn't logged in yet shows status **Invited**. From **Access Control → Users** you can **Resend** the invitation or **Revoke** it. Email invitations expire after **7 days**.

## Block or remove members

**Block** a member to immediately prevent sign-in without deleting their account (unblock later); **Remove** to take away their access. Blocking takes effect on their next request - an active session won't bypass it.

## Domain auto-join

Instead of inviting people individually, let anyone with an email on your company domain join automatically on first sign-in:

1. Open **Settings** (requires the **Manage organization** permission).
2. In the **Auto-Join Domain** card, switch the toggle **on**. The domain is taken from your account - there's nothing to type. Common public domains (such as `gmail.com`) can't be used.

New users with a matching email then join automatically with the **Viewer** role. Auto-join and invitations can be used together. See [Domain auto-join and JIT provisioning](/query-engine/guides/security/authentication/domain-auto-join-and-jit.md).

## Organization vs. workspace access

Organization membership (an org-level role of Admin / Manager / Viewer) is what invitations and auto-join control. **Workspace** access - to a specific workspace inside the organization - is managed separately, from that workspace, directly or via groups. See [Users, groups, and service accounts](/query-engine/guides/security/identity-and-rbac/users-groups-service-accounts.md).

## See also

* [Accept invites](/query-engine/get-started/identity-access-setup/accept-invites.md)
* [SSO overview](/query-engine/get-started/identity-access-setup/sso-overview.md)
* [Roles and permissions](/query-engine/guides/security/identity-and-rbac/roles-and-permissions.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.e6data.com/query-engine/get-started/identity-access-setup/organization-setup.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.