Single Sign-On (SSO) Reference

This page defines the terms and roles used across organizations and single sign-on in Ververica Cloud. It's a lookup reference, not a setup guide.

To set up SSO, start with Creating an Organization and Configuring SSO, then map your identity provider's groups to teams in Managing Access. For signing in and for automation accounts, see Authentication with SSO and API Authentication.

Key Concepts

• Identity provider (IdP): the system that verifies who a user is, for example Okta or Azure AD. Ververica Cloud trusts your identity provider's authentication and grants access based on it.
• SSO Group: a group defined in your identity provider. You map SSO Groups to Teams in Ververica Cloud so that group membership in your identity provider controls access here.
• Organization: the entity that represents your company in Ververica Cloud. You create it by converting an existing individual account.
• Organization Team: one of four fixed, built-in teams (Organization Admin, Organization User Admin, Organization Billing Admin, Organization Workspaces Admin) that Ververica Cloud creates automatically for every organization. You link each one to an SSO Group; you can't rename, delete, or add new Organization Teams.
• Team: a team you create yourself. You give it a role (Admin, Editor, or Viewer), link it to one or more SSO Groups, and assign it to one or more workspaces.
• Role: a bundle of permissions. Organization Teams get organization-level roles; Teams get workspace-level roles such as Admin, Editor, or Viewer.
• Guest: an external account you invite to a specific workspace, without adding them to your organization's SSO. Guests get Admin, Editor, or Viewer access to that one workspace only.
• Invitation: how you grant a guest access to a workspace.

Roles and Permissions Reference

The table below lists every role available in an organization, its scope, and what it lets someone do.