Create and manage an organisation

1. From your Northflank dashboard, press CMD+K or click the search icon.
2. Click Create new, then select Organisation.
3. Enter a name for your organisation.
4. Enter a contact and billing email.
5. Choose a plan.
6. Invite teammates if needed.
7. Click Create organisation.

Your organisation is now ready to use. You can add teams, invite members, configure security, and manage billing from your organisation.

If you already have a team, you can convert it to an organisation. Your existing team will become a team within the new organisation.

1. In your team dashboard, click the Team icon.
2. Click Settings in the sidebar.
3. Under Organisation, click Convert to organisation.
4. Enter the organisation name.
5. Click Convert to organisation.

Restrict teams and members

In your organisation settings, you can:

• Disable members joining external teams: Organisation members cannot join teams that do not belong to the organisation.
• Disable inviting external users to organisation teams: Users who are not members of the organisation cannot be invited to its teams.
• Use template draft system: Teams in the organisation must use the template draft system instead of editing templates directly.
• Disable PaaS deployments: Teams in the organisation cannot create projects in Northflank PaaS regions. Projects can only be created on BYOC clusters.
• Disable PaaS registry: Teams in the organisation cannot use the Northflank PaaS registry. Projects must use a self-hosted registry.
• Restrict secret groups by default: Changes the default value of the Restrict secret group option when a team in the organisation creates a new secret group. This does not enforce the restriction, and the setting can still be changed when creating the secret group. Existing secret groups are not affected.

Multifactor Authentication

You can enable require MFA from your organisation's security page to enforce multifactor authentication for your organisation members. Organisation members will be prompted to set up an authenticator application for their Northflank account before they can access Northflank, and they will need to enter their one-time passcode on every log in attempt.

You can also set a maximum login session duration in hours, which will automatically log organisation members out and require them to re-authenticate after the time period.

Clear member login sessions

You can clear member login sessions from your organisation's security page to immediately log out all user accounts from your organisation.

You can manage user roles on an organisational level to ensure compliance with your security policies, restrict users to specific teams, and grant organisational permissions.

You can add your payment method and tax ID for an organisation to manage billing for all teams in the organisation.

As well monitoring spend by project and resource type, you can also monitor spend by team.

Invoices for each team's usage can be downloaded from the team billing page.

You can connect your identity provider to Northflank so organisation members can sign in using single sign-on (SSO).

Northflank uses WorkOS SSO to connect your identity provider using SAML or OpenID Connect (OIDC).

1. In your organisation dashboard, click the Organisation icon.

2. Click SSO in the sidebar.

3. Under Link your organisation, click Add domain and enter the domain associated with your organisation, such as example.com.

4. Add any other domains used by your organisation.

5. If needed, enable Allow port security SSO with external domains. This allows users with external domains in your identity provider to access services that have this option enabled.

6. Click Update.

7. Under SSO, click Set-up SSO.

8. Follow the instructions provided by WorkOS to connect your identity provider.

9. Refresh connections to make sure SSO is working.

Once SSO is configured, users from your identity provider can sign up and sign in to Northflank using your organisation's SSO.

Users can sign in using Log in with Organisation Single Sign On on the Northflank login page, or directly at app.northflank.com/sso-login .

Some identity providers also support signing in directly from your organisation's external dashboard.

By default, Northflank uses just-in-time (JIT) provisioning. A user's Northflank account is created when they sign in for the first time using SSO.

When a user signs in for the first time using your organisation's SSO, they automatically become a member of the organisation. They cannot create teams or resources outside the organisation or leave the organisation without deactivating their account.

You can update your SSO configuration by clicking Configure SSO. To disable SSO, click Disable SSO.

Configure SSO settings

After configuring SSO, you can control how users join your organisation.

• SSO only: Disables manual email invitations. Users must join through your organisation's SSO.
• Require approval for SSO sign-ups: Adds new SSO users to an approval queue until an organisation admin approves or rejects their request.
• Restrict invites to domain: Invites can only be sent to email addresses on the organisation’s domain. Requires at least one domain to be configured for this organisation.

Convert an existing account to SSO

You can convert an existing organisation member's Northflank account to an SSO account.

1. Open your organisation's Members page.

2. Select the member you want to convert.

3. Click Convert to SSO.

The member can then sign in to Northflank using your organisation's SSO instead of their username and password.

You can connect your organisation's user directory to Northflank to automatically manage organisation members based on directory groups.

Northflank uses WorkOS Directory Sync to connect your directory.

Set up directory sync

1. In your organisation dashboard, click the Organisation icon.

2. Click SSO in the sidebar.

3. Under Directory sync, click Set-up directory sync.

4. Follow the instructions provided by WorkOS to connect your user directory.

5. Refresh connections to make sure directory sync is working.

Configure directory sync settings

• Automatically provision organisation members: Automatically create Northflank accounts for users in your directory. You can restrict provisioning to specific directory groups.
• Only sync users in specific directory groups: Restrict automatic provisioning to selected directory groups, so only users in those groups are added to your organisation.
• Sync roles with directory groups: Automatically assign or remove Northflank roles based on a user's directory group membership.