hub/main/en/organizations-security.html

<meta charset="utf-8" /><meta name="hf:doc:metadata" content="{&quot;title&quot;:&quot;Access control in organizations&quot;,&quot;local&quot;:&quot;access-control-in-organizations&quot;,&quot;sections&quot;:[{&quot;title&quot;:&quot;Viewing members’ email address&quot;,&quot;local&quot;:&quot;viewing-members-email-address&quot;,&quot;sections&quot;:[],&quot;depth&quot;:2},{&quot;title&quot;:&quot;Managing Access Tokens with access to my organization&quot;,&quot;local&quot;:&quot;managing-access-tokens-with-access-to-my-organization&quot;,&quot;sections&quot;:[],&quot;depth&quot;:2}],&quot;depth&quot;:1}">
		<link href="/docs/hub/main/en/_app/immutable/assets/0.e3b0c442.css" rel="modulepreload">
		<link rel="modulepreload" href="/docs/hub/main/en/_app/immutable/entry/start.d0cd5065.js">
		<link rel="modulepreload" href="/docs/hub/main/en/_app/immutable/chunks/scheduler.d6170356.js">
		<link rel="modulepreload" href="/docs/hub/main/en/_app/immutable/chunks/singletons.d032f1eb.js">
		<link rel="modulepreload" href="/docs/hub/main/en/_app/immutable/chunks/paths.752f1c6b.js">
		<link rel="modulepreload" href="/docs/hub/main/en/_app/immutable/entry/app.b6abe3c1.js">
		<link rel="modulepreload" href="/docs/hub/main/en/_app/immutable/chunks/index.fcd4cc08.js">
		<link rel="modulepreload" href="/docs/hub/main/en/_app/immutable/nodes/0.f045427f.js">
		<link rel="modulepreload" href="/docs/hub/main/en/_app/immutable/nodes/94.632b2a19.js">
		<link rel="modulepreload" href="/docs/hub/main/en/_app/immutable/chunks/Tip.b09c67cf.js">
		<link rel="modulepreload" href="/docs/hub/main/en/_app/immutable/chunks/EditOnGithub.da2b595c.js"><!-- HEAD_svelte-u9bgzb_START --><meta name="hf:doc:metadata" content="{&quot;title&quot;:&quot;Access control in organizations&quot;,&quot;local&quot;:&quot;access-control-in-organizations&quot;,&quot;sections&quot;:[{&quot;title&quot;:&quot;Viewing members’ email address&quot;,&quot;local&quot;:&quot;viewing-members-email-address&quot;,&quot;sections&quot;:[],&quot;depth&quot;:2},{&quot;title&quot;:&quot;Managing Access Tokens with access to my organization&quot;,&quot;local&quot;:&quot;managing-access-tokens-with-access-to-my-organization&quot;,&quot;sections&quot;:[],&quot;depth&quot;:2}],&quot;depth&quot;:1}"><!-- HEAD_svelte-u9bgzb_END -->      <p></p>  <h1 class="relative group"><a id="access-control-in-organizations" class="header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full" href="#access-control-in-organizations"><span><svg class="" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" width="1em" height="1em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 256"><path d="M167.594 88.393a8.001 8.001 0 0 1 0 11.314l-67.882 67.882a8 8 0 1 1-11.314-11.315l67.882-67.881a8.003 8.003 0 0 1 11.314 0zm-28.287 84.86l-28.284 28.284a40 40 0 0 1-56.567-56.567l28.284-28.284a8 8 0 0 0-11.315-11.315l-28.284 28.284a56 56 0 0 0 79.196 79.197l28.285-28.285a8 8 0 1 0-11.315-11.314zM212.852 43.14a56.002 56.002 0 0 0-79.196 0l-28.284 28.284a8 8 0 1 0 11.314 11.314l28.284-28.284a40 40 0 0 1 56.568 56.567l-28.285 28.285a8 8 0 0 0 11.315 11.314l28.284-28.284a56.065 56.065 0 0 0 0-79.196z" fill="currentColor"></path></svg></span></a> <span>Access control in organizations</span></h1>  <div class="course-tip  bg-gradient-to-br dark:bg-gradient-to-r before:border-green-500 dark:before:border-green-800 from-green-50 dark:from-gray-900 to-white dark:to-gray-950 border border-green-50 text-green-700 dark:text-gray-400"><p data-svelte-h="svelte-qbhm5n">You can set up <a href="./security-sso">Single Sign-On (SSO)</a> to be able to map access control rules from your organization’s Identity Provider.</p></div>  <div class="course-tip  bg-gradient-to-br dark:bg-gradient-to-r before:border-green-500 dark:before:border-green-800 from-green-50 dark:from-gray-900 to-white dark:to-gray-950 border border-green-50 text-green-700 dark:text-gray-400"><p data-svelte-h="svelte-17i0wym">Advanced and more fine-grained access control can be achieved with <a href="./security-resource-groups">Resource Groups</a>.</p> <p data-svelte-h="svelte-rdrrta">The Resource Group feature is part of the <a href="https://huggingface.co/enterprise" target="_blank">Enterprise Hub</a>.</p></div> <p data-svelte-h="svelte-un9p1c">Members of organizations can have four different roles: <code>read</code>, <code>contributor</code>, <code>write</code>, or <code>admin</code>:</p> <ul data-svelte-h="svelte-mjeun0"><li><p><code>read</code>: read-only access to the Organization’s repos and metadata/settings (eg, the Organization’s profile, members list, API token, etc).</p></li> <li><p><code>contributor</code>: additional write rights to the subset of the Organization’s repos that were created by the user. I.e., users can create repos and <em>then</em> modify only those repos. This is similar to the <code>write</code> role, but scoped to repos <em>created</em> by the user.</p></li> <li><p><code>write</code>: write rights to all the Organization’s repos. Users can create, delete, or rename any repo in the Organization namespace. A user can also edit and delete files from the browser editor and push content with <code>git</code>.</p></li> <li><p><code>admin</code>: in addition to write rights on repos, admin members can update the Organization’s profile, refresh the Organization’s API token, and manage Organization members.</p></li></ul> <p data-svelte-h="svelte-kf3l5c">As an organization <code>admin</code>, go to the <strong>Members</strong> section of the org settings to manage roles for users.</p> <div class="flex justify-center" data-svelte-h="svelte-1d302st"><img class="block dark:hidden" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/org-members-page.png"> <img class="hidden dark:block" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/org-members-page-dark.png"></div>  <h2 class="relative group"><a id="viewing-members-email-address" class="header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full" href="#viewing-members-email-address"><span><svg class="" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" width="1em" height="1em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 256"><path d="M167.594 88.393a8.001 8.001 0 0 1 0 11.314l-67.882 67.882a8 8 0 1 1-11.314-11.315l67.882-67.881a8.003 8.003 0 0 1 11.314 0zm-28.287 84.86l-28.284 28.284a40 40 0 0 1-56.567-56.567l28.284-28.284a8 8 0 0 0-11.315-11.315l-28.284 28.284a56 56 0 0 0 79.196 79.197l28.285-28.285a8 8 0 1 0-11.315-11.314zM212.852 43.14a56.002 56.002 0 0 0-79.196 0l-28.284 28.284a8 8 0 1 0 11.314 11.314l28.284-28.284a40 40 0 0 1 56.568 56.567l-28.285 28.285a8 8 0 0 0 11.315 11.314l28.284-28.284a56.065 56.065 0 0 0 0-79.196z" fill="currentColor"></path></svg></span></a> <span>Viewing members’ email address</span></h2>  <div class="course-tip course-tip-orange bg-gradient-to-br dark:bg-gradient-to-r before:border-orange-500 dark:before:border-orange-800 from-orange-50 dark:from-gray-900 to-white dark:to-gray-950 border border-orange-50 text-orange-700 dark:text-gray-400">This feature is part of the <a href="https://huggingface.co/enterprise" target="_blank" data-svelte-h="svelte-170ex92">Enterprise Hub</a>.</div> <p data-svelte-h="svelte-1lhf253">You may be able to view the email addresses of members of your organization. The visibility of the email addresses depends on the organization’s SSO configuration, or verified organization status.</p> <ul data-svelte-h="svelte-ky5rt6"><li>If you <a href="./organizations-managing#organization-domain-name">verify a domain for your organization</a>, you can view members’ email addresses for the verified domain.</li> <li>If SSO is configured for your organization, you can view the email address for each of your organization members by setting <code>Matching email domains</code> in the SSO configuration</li></ul> <div class="flex justify-center" data-svelte-h="svelte-1nv1xin"><img class="block dark:hidden" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/org-members-page-emails.png"> <img class="hidden dark:block" src="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/org-members-page-emails-dark.png"></div>  <h2 class="relative group"><a id="managing-access-tokens-with-access-to-my-organization" class="header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full" href="#managing-access-tokens-with-access-to-my-organization"><span><svg class="" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" width="1em" height="1em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 256"><path d="M167.594 88.393a8.001 8.001 0 0 1 0 11.314l-67.882 67.882a8 8 0 1 1-11.314-11.315l67.882-67.881a8.003 8.003 0 0 1 11.314 0zm-28.287 84.86l-28.284 28.284a40 40 0 0 1-56.567-56.567l28.284-28.284a8 8 0 0 0-11.315-11.315l-28.284 28.284a56 56 0 0 0 79.196 79.197l28.285-28.285a8 8 0 1 0-11.315-11.314zM212.852 43.14a56.002 56.002 0 0 0-79.196 0l-28.284 28.284a8 8 0 1 0 11.314 11.314l28.284-28.284a40 40 0 0 1 56.568 56.567l-28.285 28.285a8 8 0 0 0 11.315 11.314l28.284-28.284a56.065 56.065 0 0 0 0-79.196z" fill="currentColor"></path></svg></span></a> <span>Managing Access Tokens with access to my organization</span></h2> <p data-svelte-h="svelte-1cixexk">See <a href="./enterprise-hub-tokens-management">Tokens Management</a></p> <a class="!text-gray-400 !no-underline text-sm flex items-center not-prose mt-4" href="https://github.com/huggingface/hub-docs/blob/main/docs/hub/organizations-security.md" target="_blank"><span data-svelte-h="svelte-1kd6by1">&lt;</span> <span data-svelte-h="svelte-x0xyl0">&gt;</span> <span data-svelte-h="svelte-1dajgef"><span class="underline ml-1.5">Update</span> on GitHub</span></a>  <p></p> 
			
			<script>
				{
					__sveltekit_1vatp3t = {
						assets: "/docs/hub/main/en",
						base: "/docs/hub/main/en",
						env: {}
					};

					const element = document.currentScript.parentElement;

					const data = [null,null];

					Promise.all([
						import("/docs/hub/main/en/_app/immutable/entry/start.d0cd5065.js"),
						import("/docs/hub/main/en/_app/immutable/entry/app.b6abe3c1.js")
					]).then(([kit, app]) => {
						kit.start(app, element, {
							node_ids: [0, 94],
							data,
							form: null,
							error: null
						});
					});
				}
			</script>