Single Sign-On (SSO) Reference

Key Concepts

• Identity provider (IdP): the system that verifies who a user is, for example Okta or Azure AD. Ververica Cloud trusts your identity provider's authentication and grants access based on it.
• SSO Group: a group defined in your identity provider. You map SSO Groups to Teams in Ververica Cloud so that group membership in your identity provider controls access here.
• Organization: the entity that represents your company in Ververica Cloud. You create it by converting an existing individual account.
• Organization Team: one of four fixed, built-in teams (Organization Admin, Organization User Admin, Organization Billing Admin, Organization Workspaces Admin) that Ververica Cloud creates automatically for every organization. You link each one to an SSO Group; you can't rename, delete, or add new Organization Teams.
• Team: a team you create yourself. You give it a role (Admin, Editor, or Viewer), link it to one or more SSO Groups, and assign it to one or more workspaces.
• Role: a bundle of permissions. Organization Teams get organization-level roles; Teams get workspace-level roles such as Admin, Editor, or Viewer.
• Guest: an external account you invite to a specific workspace, without adding them to your organization's SSO. Guests get Admin, Editor, or Viewer access to that one workspace only.
• Invitation: how you grant a guest access to a workspace.

Roles and Permissions Reference

The table below lists every role available in an organization, its scope, and what it lets someone do.