How to invite users to a tenant

Documentation Index

Fetch the complete documentation index at: https://docs.nebius.com/llms.txt

Use this file to discover all available pages before exploring further.

• If you have created a federation and configured single sign-on, you can create user accounts in your application in one of the supported identity providers. Then, users can sign in to Nebius AI Cloud by using the federation ID.
• If you do not have a federation or you want to use an alternative method, you can send invitations to users from Nebius AI Cloud. In this case, users receive their invitations via email. Once the user accepts the invitation, they can sign in by using any available method, including the federation ID. An invitation is valid for three days.

1. Create it:
   • Web console
   • CLI
   • Terraform

   1. In the sidebar, go to  Administration → IAM.
   2. Open the Invitations tab.
   3. Click  Create invitation.
   4. In the window that opens, specify the email of the user whom you would like to invite.
   5. Click Create.

   Run the following command:

   nebius iam invitation create --parent-id <tenant_ID> --email <user_email> 
   

   In the command, specify:

   • --email: Email of the user whom you would like to invite.
   • --parent-id: Tenant ID.

   1. Install and configure the Nebius AI Cloud provider for Terraform.
   2. Create the following configuration file:
      resource "nebius_iam_v1_invitation" "<invitation_name>" {
        parent_id = "<tenant_ID>"
        email     = "<email>"
      }
      
      In the file, specify:
      • email: Email of the user whom you would like to invite.
      • parent_id: Tenant ID.
   3. Check that the configuration is correct:
      terraform validate
      
   4. Apply the changes:
      terraform apply
      
   The invitation to the tenant is sent to the specified email.
2. Add the user to the required group. You can do it at any time, even before the user accepts their invitation.
   • Web console
   • CLI
   • Terraform

   1. In the sidebar, go to  Administration → IAM.
   2. Open the Invitations tab.
   3. In the line of the invited user, click  → Add to group. If you cannot find the user in the list of pending invitations, switch to accepted invitations.
   4. In the window that opens, select the groups to which you want to add the user.
   5. Click Close.

   1. Get a list of groups, so you can choose the group for the user and copy the group ID:
      nebius iam group list --parent-id <tenant_ID>
      
      Save the metadata.id value for the required group.
   2. Get the ID of the invited user:
      nebius iam invitation list --parent-id <tenant_ID>
      
      Save the metadata.status.tenant_user_account_id value for the required user.
   3. Assign the group to the user:
      nebius iam group-membership create \
        --parent-id group-*** \
        --member-id tenantuseraccount-***
      
      Specify the group and user ID that you saved earlier.

   1. In the directory with the already created Terraform manifest, add the following configuration file:
      resource "nebius_iam_v1_group_membership" "<group_membership_name>" {
        parent_id = data.nebius_iam_v1_group.<group_name>.id
        member_id = nebius_iam_v1_invitation.<invitation_name>.status.tenant_user_account_id
      }
      
      data "nebius_iam_v1_group" "<group_name>" {
        parent_id = "<tenant_ID>"
        name      = "<group_name>"
      }
      
      The file contains the following:
      • Resource that adds a group to the user. In the resource, specify the names of the group and invitation resources.
      • Data source that you use to get the group ID. In the data source, specify the tenant ID and the name of the group to which you want to add the user.
   2. Check that the configuration is correct:
      terraform validate
      
   3. Apply the changes:
      terraform apply