You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
docs: HCP organization "owner" role changes (#1150)
### Description
This PR updates HCP platform documentation. Previously, an organization
supported a single non-transferrable owner. To better support business
continuity, organizations now allow up to 3 users with the `owner` role.
These owners can be added or removed as desired, although one user must
always be an `owner` for the organization.
## Preview links
Copy file name to clipboardExpand all lines: content/hcp-docs/content/docs/changelog.mdx
+5Lines changed: 5 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,6 +6,11 @@ description: |-
6
6
---
7
7
8
8
# Changelog
9
+
### 2025-11-27
10
+
HCP organizations now support the assignment of the Owner role to multiple users. This enhancement creates a more resilient administrative model, eliminating the business continuity risks and operational bottlenecks associated with single-principal ownership. For more information, refer to the [access management documentation.](/hcp/docs/hcp/iam/access-management)
11
+
12
+
Key Update:
13
+
* Multi-Owner Support: Owners can now delegate the Owner role to additional users, ensuring redundancy if another owner is unavailable.
9
14
10
15
### 2025-11-12
11
16
HCP Consul dedicated reached its End-of-Life (EOL) on November 12, 2025, and is no longer available. All active clusters and associated project data were decommissioned in accordance with our EOL policy. For questions about your account and data, or for help migrating to a self-managed Consul deployment, contact our support team.
Copy file name to clipboardExpand all lines: content/hcp-docs/content/docs/hcp/admin/orgs.mdx
+20-8Lines changed: 20 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,11 +11,11 @@ This page describes how to create and manage an organization in HashiCorp Cloud
11
11
## Introduction
12
12
13
13
An _organization_ is a top-level entity in HCP for organizing resources. It contains one or more
14
-
[HCP projects](/hcp/docs/hcp/admin/projects), which separate access to resources such as [HashiCorp Virtual Networks (HVN)](/hcp/docs/hcp/network) according to [user permissions](/hcp/docs/iam/users#user-permissions).
14
+
[HCP projects](/hcp/docs/hcp/admin/projects), which separate access to resources such as [HashiCorp Virtual Networks (HVN)](/hcp/docs/hcp/network) according to [user permissions](/hcp/docs/iam/users#user-permissions). An organization can have up to 100 projects.
15
15
16
-
Users can be a member of multiple organizations if invited by the admin of other organizations. However, you can only create and own one organization for your HCP account.
16
+
Users can be a member of multiple organizations, and organizations can have a maximum of 3 users with the `owner` role. Users with the `owner` role can add and remove other organization owners over time, but organizations require at least one owner at all times.
17
17
18
-
An organization can have up to 100 projects.
18
+
You cannot create an organization if you are already the owner of an existing organization.
19
19
20
20
## Create an organization
21
21
@@ -31,17 +31,29 @@ After you create your organization, you can [invite users to your organization](
31
31
32
32
To locate the organization ID:
33
33
34
-
1. At the bottom left, click the name of the current organization to open the organization and project selector.
35
-
1. Select an organization to open the organization's dashboard.
36
-
1. From the organization's dashboard, click **Organization settings**.
34
+
1. At the top, click the dropdown to open the organization and project selector. Select **View all organizations**.
35
+
1. Click the name of the organization.
36
+
1. From the **Organization dashboard**, click **Organization settings**.
37
+
1. Click the clipboard icon next to the ID to copy the **Organization ID**.
38
+
39
+
## Find organization owners
40
+
41
+
An organization can have one to three users with the `owner` role. Owners can change, but there must always be at least one owner per organization.
42
+
43
+
To find the organization's current owners, perform the following steps:
44
+
45
+
1. At the top, click the dropdown to open the organization and project selector. Select **View all organizations**.
46
+
1. Click the name of the organization.
47
+
1. From the **Organization dashboard**, click **Organization settings**.
37
48
1. To copy the **Organization ID**, click the clipboard icon next to the ID.
38
49
39
50
## Manage an organization
40
51
41
52
To change your organization's name:
42
53
43
-
1. Sign in to [the HCP Portal](https://portal.cloud.hashicorp.com/).
44
-
1. From the organization's dashboard, click **Organization settings**.
54
+
1. At the top, click the dropdown to open the organization and project selector. Select **View all organizations**.
55
+
1. Click the name of the organization.
56
+
1. From the **Organization dashboard**, click **Organization settings**.
45
57
1. At the top-right, click **Manage**, and then click **Rename organization**.
46
58
1. Enter a new organization name. The name must contain between 3 and 40 characters, and it may include ASCII letters, numbers, hyphens, and underscores. The name must be unique. If another organization is already using the name, you will receive a prompt to choose a different one.
Copy file name to clipboardExpand all lines: content/hcp-docs/content/docs/hcp/admin/projects/index.mdx
+20-43Lines changed: 20 additions & 43 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,36 +6,26 @@ description: |-
6
6
7
7
# Projects
8
8
9
-
Projects are lightweight containers for resources or use cases that require similar access. An organization contains one or more projects. HCP resources such as [HashiCorp Virtual Networks
10
-
(HVN)](/hcp/docs/hcp/network) and server clusters reside within Projects.
9
+
Projects are lightweight containers for resources or use cases that require similar access. An organization contains one or more projects. HCP resources such as [HashiCorp Virtual Networks (HVN)](/hcp/docs/hcp/network) and server clusters reside within projects.
11
10
12
-
Use projects to segment access within an organization. For example, projects can separate teams, use cases, or environments, such as development, staging, and production. The billing summary reports usage per project.
11
+
Use projects to segment access within an organization. For example, projects can separate teams, use cases, or environments, such as development, staging, and production. The billing summary reports usage per project.
13
12
14
13
Here are important characteristics about HCP projects:
15
14
16
15
-_Global_[HCP service quotas](/hcp/docs/hcp/admin/support#service-quotas) remain at the
17
-
organization level and they are not enforced per project.
16
+
organization level and they are not enforced per project. Refer the [HCP Support](/hcp/docs/hcp/admin/support) page to learn more about the service quotas.
18
17
19
18
- An [organization](/hcp/docs/hcp/admin/orgs) can contain 1 or more projects.
20
19
21
-
<Note>
20
+
- HCP resource names, such as a cluster name, are unique to projects.
22
21
23
-
Refer the [HCP
24
-
Support](/hcp/docs/hcp/admin/support) page to learn more about the service
25
-
quotas.
26
-
27
-
</Note>
28
-
29
-
- HCP resource names (e.g. cluster name) are unique per project and not per
30
-
organization.
31
-
32
-
- You cannot deploy an HCP Vault Dedicated cluster if an
33
-
HVN belongs to a different project.
22
+
- You cannot deploy an HCP Vault Dedicated cluster if an HVN belongs to a different project.
34
23
35
24
- To delete a project, all resources under the project must be deleted or
36
-
deactivated first. See the [manage resources](#manage-resources) section.
25
+
deactivated first. Refer to [manage resources](#manage-resources) for more information.
26
+
27
+
## Use Cases
37
28
38
-
### Use Cases
39
29
Taking advantage of segregating access within your organization via projects is the best way to enforce least privileged access. Deploying all HCP services or resources within one project, can lead to several unintended consequences.
40
30
41
31
- Increased likelihood of over privileging identities within the project
@@ -46,55 +36,42 @@ Taking advantage of segregating access within your organization via projects is
46
36
47
37
Users with organization contributor, admin, or owner roles can create new
48
38
projects. If an organization contributor creates a new project, the user
49
-
automatically becomes the admin of that project. (Refer to the [User
50
-
Permissions](/hcp/docs/hcp/admin/users#user-permissions) for information about
51
-
the roles you can assign.)
39
+
automatically becomes the admin of that project. Refer to the [User Permissions](/hcp/docs/hcp/admin/users#user-permissions) for information about
40
+
the roles you can assign.
52
41
53
42
1. Log into [HCP Portal](https://portal.cloud.hashicorp.com/) and choose your
54
-
organization.
55
-
56
-
<Note>
57
-
58
-
If you have logged in before, the portal opens the last project you were in.
59
-
Navigate back to the organization level from the breadcrumbs, or click on the
60
-
HashiCorp icon at the top-left to choose your organization.
61
-
62
-
</Note>
43
+
organization. If you have logged in before, the portal opens the last project you were in.
44
+
Navigate to the Organization to change projects.
63
45
64
46
1. Select **Projects** in the sidebar.
65
47
66
-
1. Click **+ Create project**.
48
+
1. Click **Create project**.
67
49
68
50
1. Enter the **Project name** and **Project description**.
69
51
70
52
1. Click **Create project** to complete.
71
53
72
-
73
54
## Manage projects
74
55
75
-
Users with project admin role can edit the existing project name and
76
-
description, or delete the project. (Refer to the [User
77
-
Permissions](/hcp/docs/hcp/admin/users#user-permissions) for information about
78
-
the roles you can assign.)
56
+
Users with project owner and admin roles can edit the existing project name and
57
+
description, or delete the project. Refer to [User Permissions](/hcp/docs/hcp/admin/users#user-permissions) for information about
58
+
the roles you can assign.
79
59
80
60
1. Log into [HCP Portal](https://portal.cloud.hashicorp.com/) and choose your
81
61
organization.
82
62
83
63
1. Select **Projects** in the sidebar.
84
64
85
-
1. Expand the menu next to the project you wish to modify, and select **Edit
86
-
project** to edit the project name or description, or select **Delete** to
65
+
1. Expand the menu next to the project you wish to modify.
66
+
Select **Edit project** to edit the project name or description, or select **Delete** to
A resource is any item that the access management system controls access to. Examples of resources are a HCP Vault Dedicated cluster, HCP Packer Bucket, HashiCorp Virtual Network (HVN) or a HCP Vault Secret App. The **Active Resources** page lists all resources created in the project. To delete a project, all resources must be deleted. If an resource exists, HCP will block users from deleting the project. This page helps you to identify what resources are still in the project.
75
+
A resource is any item that the access management system controls access to. Examples of resources are an HCP Vault Dedicated cluster, an HCP Packer Bucket, or a HashiCorp Virtual Network (HVN). The **Active Resources** page lists all resources created in the project. To delete a project, all resources must be deleted. If a resource exists, HCP blocks users from deleting the project. This page helps you to identify what resources are still in the project.
Copy file name to clipboardExpand all lines: content/hcp-docs/content/docs/hcp/create-account.mdx
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,7 +12,7 @@ This page explains how to create an account in HashiCorp Cloud Platform (HCP) an
12
12
13
13
To meet data residency requirements, HCP requires separate accounts for the global and European geographies.
14
14
15
-
To create a global HCP account, sign up on [the HCP portal](https://portal.cloud.hashicorp.com/). To an HCP Europe account, sign up on [the HCP Europe portal](https://portal.cloud.eu.hashicorp.com/).
15
+
To create a global HCP account, sign up on [the HCP portal](https://portal.cloud.hashicorp.com/). To create an HCP Europe account, sign up on [the HCP Europe portal](https://portal.cloud.eu.hashicorp.com/).
16
16
17
17
For more information, refer to [HCP Europe](/hcp/docs/hcp/europe).
Copy file name to clipboardExpand all lines: content/hcp-docs/content/docs/hcp/iam/access-management.mdx
+39-11Lines changed: 39 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,21 +8,37 @@ description: |-
8
8
9
9
This topic describes HCP's access management features. You can set roles and permissions at either the _organization level_ , _project level_ or _resource level_ to secure access to HCP resources.
The following tables describe role permissions assigned at the organization level.
17
+
To assign roles at a fine-grained level using the HCP platform, users must have one of the following permissions:
18
18
19
-
<Tabs>
20
-
<Tabheading="All Services"group="all-services">
19
+
-`owner` role for the HCP organization
20
+
-`admin` role for the HCP organization
21
+
-`Organization IAM policies administrator` role
22
+
23
+
To assign a new role:
24
+
25
+
1. At the top, click the dropdown to open the organization and project selector. Select **View all organizations**.
26
+
1. Click the name of the organization.
27
+
1. From the **Organization dashboard**, click **Access Control (IAM)**.
28
+
1. Click **Add new assignment**. If you are not an organization's owner, this option does not appear.
29
+
1. Enter the user's email address.
30
+
31
+
You can change the user's role assignment and the service associated with that role assignment using the drop-down menus. When you set a role assignment for all services, it sets the user's role in the organization.
32
+
33
+
## Organization level roles and permissions
34
+
35
+
The following table describes the roles and permissions available at the organizational level.
21
36
22
37
| HCP Organization Permissions | Owner | Admin | Contributor | Viewer | Browser | No role |
@@ -75,7 +93,6 @@ The following tables describe role permissions assigned at the organization leve
75
93
| Manage SSO and SCIM configuration |❌|
76
94
| Manage billing resources |✅|
77
95
78
-
79
96
</Tab>
80
97
81
98
<Tabheading="IAM"group="iam">
@@ -128,7 +145,17 @@ To learn more about each permission, refer to [HCP Terraform organization permis
128
145
129
146
A user can be a part of an organization with no roles assigned directly to them through the [SSO default role settings](/hcp/docs/hcp/admin/iam/sso) or IAM settings. To enforce least-privileged access, new users will have a limited experience within the platform until an Admin assigns either an organization or project role to the user.
130
147
131
-
### Project
148
+
## View current role assignments
149
+
150
+
To view a list of current role assignments in an organization, perform the following steps:
151
+
152
+
1. At the top, click the dropdown to open the organization and project selector. Select **View all organizations**.
153
+
1. Click the name of the organization.
154
+
1. From the **Organization dashboard**, click **Access Control (IAM)**.
155
+
156
+
The **Role assignments** page lists the currently assigned roles and provides an interface to search and filter the current assignments.
157
+
158
+
## Project level roles and permissions
132
159
133
160
The following tables describe role permissions scope to the project level.
134
161
@@ -227,19 +254,20 @@ To learn more about each permission, refer to [HCP Terraform project permissions
To interact with the HCP Access Management system using the [HCP Terraform provider](https://registry.terraform.io/providers/hashicorp/hcp/latest) or public APIs, you must properly format the role IDs you reference.The table lists role names and the formatting of their Role IDs.
263
+
To interact with the HCP Access Management system using the [HCP Terraform provider](https://registry.terraform.io/providers/hashicorp/hcp/latest) or public APIs, you must properly format the role IDs you reference.The following able lists role names and the formatting of their Role IDs.
Copy file name to clipboardExpand all lines: content/hcp-docs/content/docs/hcp/iam/users.mdx
+7-6Lines changed: 7 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,14 +6,14 @@ description: |-
6
6
7
7
# Users
8
8
9
+
This page describes how to add users to your HashiCorp Cloud Platform (HCP) account and manage their access to resources.
10
+
11
+
## Introduction
12
+
9
13
When you sign up for a HashiCorp Cloud Platform (HCP) account for the first
10
-
time, the HCP Portal takes you to the [create
11
-
organization](https://portal.cloud.hashicorp.com/orgs/create) page to set up
12
-
your organization. You can invite additional users to the organization so that
14
+
time, the HCP Portal takes you to the [create organization](https://portal.cloud.hashicorp.com/orgs/create) page to set up your organization. You can invite additional users to the organization so that
13
15
they can access the resources.
14
16
15
-
This page describes how to add users to your HashiCorp Cloud Platform (HCP) account and manage their access to resources.
16
-
17
17
## Invite users
18
18
19
19
Use the following procedure to invite users into your organization using email.
For more information about permissions, the different types of roles and how they can be used within HCP, checkout the [Access Management](/hcp/docs/hcp/iam/access-management) page.
0 commit comments