How to invite users to a tenant

• If you have created a federation and configured single sign-on, you can create user accounts in your application in one of the supported identity providers. Then, users can sign in to Nebius AI Cloud by using the federation ID.
• If you do not have a federation or you want to use an alternative method, you can send invitations to users from Nebius AI Cloud. In this case, users receive their invitations via email. Once the user accepts the invitation, they can sign in by using any available method, including the federation ID. By default, an invitation is valid for three days. When you create invitations by using the CLI, you can customize this period with the --expires-in parameter.

​

Sending an invitation

1. Create it:
   • Web console
   • CLI
   • Terraform

   1. In the sidebar, go to  Administration → IAM.
   2. On the Users tab, click Invite user.
   3. In the window that opens, specify the Email of the user whom you would like to invite.
   4. (Optional) From the Groups list, select the groups you want to add the user to. You can skip the next step to add the user to a group if you set group membership when you create the invitation.
   5. Click Invite user.

   Run the following command:

   nebius iam invitation create --parent-id <tenant_ID> --email <user_email> --expires-in 24h 
   

   In the command, specify:

   • --email: Email of the user whom you would like to invite.
   • --parent-id: Tenant ID.
   • --expires-in (optional): How long the invitation remains valid after creation. If omitted, the invitation is valid for three days.

   1. Install and configure the Nebius AI Cloud provider for Terraform.
   2. Create the following configuration file:
      resource "nebius_iam_v1_invitation" "<invitation_name>" {
        parent_id = "<tenant_ID>"
        email     = "<user_email>"
      }
      
      In the file, specify:
      • email: Email of the user whom you would like to invite.
      • parent_id: Tenant ID.
   3. Check that the configuration is correct:
      terraform validate
      
   4. Apply the changes:
      terraform apply
      
   The invitation to the tenant is sent to the specified email.
2. Add the user to the required group. You can do it at any time, even before the user accepts their invitation.
   • Web console
   • CLI
   • Terraform

   Only do this if the user wasn’t added to a group during invitation in the previous step.

   1. In the sidebar, go to  Administration → IAM.
   2. On the Users tab, find the user. To find a user with a pending invitation, filter the list by Status and select Invited. To find a user with an expired invitation, filter the list by Status and select Expired. Next to the user, click → Resend invitation. The user will reappear in the list of invited users.
   3. Next to the user, click  → Add user to group.
   4. In the window that opens, select the groups you want to add the user to.
   5. Click Close.

   1. Get a list of groups, so you can choose the group for the user and copy the group ID:
      nebius iam group list --parent-id <tenant_ID>
      
      Save the metadata.id value for the required group.
   2. Get the ID of the invited user:
      nebius iam invitation list --parent-id <tenant_ID>
      
      Save the metadata.status.tenant_user_account_id value for the required user.
   3. Assign the group to the user:
      nebius iam group-membership create \
        --parent-id group-*** \
        --member-id tenantuseraccount-***
      
      Specify the group and user ID that you saved earlier.

   1. In the directory with the already created Terraform manifest, add the following configuration file:
      resource "nebius_iam_v1_group_membership" "<group_membership_name>" {
        parent_id = data.nebius_iam_v1_group.<group_name>.id
        member_id = nebius_iam_v1_invitation.<invitation_name>.status.tenant_user_account_id
      }
      
      data "nebius_iam_v1_group" "<group_name>" {
        parent_id = "<tenant_ID>"
        name      = "<group_name>"
      }
      
      The file contains the following:
      • Resource that adds a group to the user. In the resource, specify the names of the group and invitation resources.
      • Data source that you use to get the group ID. In the data source, specify the tenant ID and the name of the group to which you want to add the user.
   2. Check that the configuration is correct:
      terraform validate
      
   3. Apply the changes:
      terraform apply
      

​

Managing invitations

For a user with the Invited status, you can see how many days are left before the invitation expires. To manage the invitation, click next to the user and select:

• Resend invitation: send the invitation email again.
• Delete invitation: cancel the invitation.