# Manage organizations and teams

An organization is a separate space for one customer or team, with its own members, groups, enrollment keys, devices, sessions and recordings. If you are a managed service provider, create one organization per customer. People in one organization can't see another organization's devices or sessions unless they are given access to it.

## Switch between organizations

The organization switcher at the top of the console shows the organization you are working in. Open it to search for and pick another organization, or choose **All organizations** for an overview across every organization you can reach.

The **Organizations** page, under **Organization** in the sidebar, lists every organization you can reach and how you reach it under **Your access**. Select **Switch** to work in another one.

## Create an organization

You need the **Create organizations** instance permission.

If your plan does not include **Multiple organizations**, you can have one organization. Once it exists, **Multiple organizations: not in your plan** shows in place of **New organization**. Your first organization never needs it. See [Understand your plan and its limits](/configure/plans-and-limits/).

1. Open **Organizations** and select **New organization**. You can also do this from **Instance** › **Organizations**.
2. Enter a **Name**, for example the customer's company name.
3. Select **Create**.

You become the organization's first **Owner**. Everything else (team, groups, enrollment keys and devices) starts empty. Next, add the team and [enroll devices](/install/).

**Instance** › **Organizations** lists every organization on your server, whether or not you are a member, with its status and its numbers of members and devices.

## Rename an organization

You need the **Edit organization** permission.

1. Switch to the organization and open **Organizations**.
2. In the **Current organization** panel, select **Rename**.
3. Enter the new **Name** and select **Rename**.

The organization's slug (its short identifier) stays the same.

## Delete an organization

You need the **Delete organization** permission in that organization, or the **Delete any organization** instance permission.

1. Switch to the organization and open **Organizations**, then select **Delete** in the **Current organization** panel. Instance administrators can also use the bin icon on **Instance** › **Organizations**.
2. Type the organization's name to confirm.
3. Select **Delete organization**.

:::danger
After deletion, nobody can reach the organization's devices, sessions or recordings, and its enrollment keys stop working. Agents already installed on its devices stay installed.
:::

## Limit where devices connect from

Each organization can have an agent IP rule: a list of IP ranges and countries its Access devices may connect from. It covers their connection to the server, Access sessions, terminals and enrollment. Support sessions are never restricted.

1. Switch to the organization (not **All organizations**) and open **Organizations**.
2. Use the **Agent IP rules** card below the **Current organization** panel.

You need **View agent IP rules** to see the card and **Manage agent IP rules** to change it. A device outside the rule shows **blocked by IP rule** in the device list. See [Restrict access by IP address and country](/configure/ip-and-country-rules/#set-an-organizations-agent-rule).

## Manage the team

The **Team** page shows who belongs to the current organization and what role they have there. A member's role applies to the whole organization.

### Add a member

The person must already have a Blink user account. Blink does not send email invitations: an instance administrator first creates the account on the **Users** page (see [Add and manage users](/configure/users/)). Someone with the **Manage users** instance permission can add any user. Other team managers can only add people who are already in an organization they can access.

1. Open **Team** and select **Add member**.
2. Enter the person's **Email**.
3. Choose a **Role**. Roles are grouped as **Built-in**, **Instance** and **Organization**. Choose **Member (group access only)** if the person should only reach the devices in certain groups.
4. Select **Add member**.

You need the **Add members** permission. Giving someone the **Owner** role also needs **Manage owners**.

### Change a member's role

On the **Team** page, pick a new role in the member's **Role** list. You need the **Change member roles** permission, and **Manage owners** to give or take the **Owner** role.

:::note
An organization always keeps at least one active **Owner**. Blink refuses to change the role of, suspend or remove the last one.
:::

### Suspend or reactivate a member

Suspending keeps the membership but blocks the person's access to this organization. You need the **Change member roles** permission.

- To suspend, select the pause icon on the member's row.
- To reactivate, select the play icon.

You can't suspend yourself.

### Remove a member

Select the bin icon on the member's row and confirm with **Remove**. The person loses access to this organization and all their group roles here. Their user account stays. You need the **Remove members** permission.

### Access from the instance

The **Access from the instance** card on the **Team** page lists people who reach this organization without being members:

- **Instance owners**, who have every permission in every organization except the terminal and Backstage as SYSTEM permissions, which only a role can give.
- People with an instance role given for **All organizations** or **Selected organizations** on the **Users** page.

You change this access on the **Users** page. See [Add and manage users](/configure/users/#give-a-user-a-role).

## Related

- [Roles and permissions](/configure/roles/)
- [Limit access with groups](/configure/groups/)
- [Restrict access by IP address and country](/configure/ip-and-country-rules/)
- [Choose the name customers see](/configure/technician-name/), which each organization can set for itself