> ## Documentation Index
> Fetch the complete documentation index at: https://developers.essal.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Organizations

> Understand how Essal Organizations group multiple workspaces under a single account for enterprise deployments.

An **Organization** is a parent-level entity that groups one or more Workspaces. Organizations are designed for enterprise customers who operate multiple business units, regional subsidiaries, or isolated environments under a single billing and governance structure.

## Organization vs Workspace

| Concept          | Scope  | Purpose                                      |
| ---------------- | ------ | -------------------------------------------- |
| **Organization** | Parent | Billing, shared identity, governance policy  |
| **Workspace**    | Child  | Operational data, app configuration, members |

A workspace always belongs to exactly one organization. Members can exist in multiple workspaces within the same org but are managed through a single identity in Access.

## Shared Identity Provider

Organizations can configure a single SSO connection in Access that applies across all child workspaces. Users authenticate once and receive tokens scoped to each workspace they belong to.

```json theme={null}
{
  "org_id": "org_01HXYZDEF",
  "name": "Acme Group",
  "sso_provider": "okta",
  "workspaces": [
    { "id": "ws_01HXYZABC", "slug": "acme-emea" },
    { "id": "ws_01HXYZXYZ", "slug": "acme-apac" },
    { "id": "ws_01HXYZNOP", "slug": "acme-americas" }
  ]
}
```

## Inherited Settings

Certain Guard policies and compliance settings defined at the organization level are automatically inherited by all child workspaces. Workspace admins can view but not override inherited settings.

Inherited settings include:

* Minimum password policy
* MFA enforcement
* IP allowlist ranges
* Audit log retention period

<Note>
  Workspace-level settings take precedence over inherited settings where they are more restrictive. A workspace cannot be configured to be less restrictive than the org-level baseline.
</Note>

## Organization API Object

```json theme={null}
{
  "id": "org_01HXYZDEF",
  "name": "Acme Group",
  "slug": "acme-group",
  "plan": "enterprise",
  "workspace_count": 3,
  "member_count": 480,
  "created_at": "2024-08-01T00:00:00Z"
}
```

## Managing Organizations

Organizations are managed through the Essal admin dashboard at [admin.essal.cloud/org](https://admin.essal.cloud/org) or via the API using a workspace admin token with the `workspace:admin` role.