3.2 KiB
| stage | group | info | type |
|---|---|---|---|
| Manage | Authentication and Authorization | To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/product/ux/technical-writing/#assignments | reference |
Enterprise users (PREMIUM SAAS)
Enterprise users have user accounts that are administered by an organization that has purchased a GitLab subscription.
Enterprise users are identified by the Enterprise badge next to their names on the Members list.
Provision an enterprise user
A user account is considered an enterprise account when:
- A user without an existing GitLab user account uses the group's SAML SSO to sign in for the first time.
- SCIM creates the user account on behalf of the group.
A user can also manually connect an identity provider (IdP) to a GitLab account whose email address matches the subscribing organization's domain. By selecting Authorize when connecting these two accounts, the user account with the matching email address is classified as an enterprise user. However, this user account does not have an Enterprise badge in GitLab.
Although a user can be a member of more than one group, each user account can be provisioned by only one group. As a result, a user is considered an enterprise user under one top-level group only.
Manage enterprise users in a namespace
A top-level Owner of a namespace on a paid plan can retrieve information about and manage enterprise user accounts in that namespace.
These enterprise user-specific actions are in addition to the standard group member permissions.
Disable two-factor authentication
Introduced in GitLab 15.8.
Top-level group Owners can disable two-factor authentication (2FA) for enterprise users.
To disable 2FA:
- On the top bar, select Main menu > Groups and find your group.
- On the left sidebar, select Group information > Members.
- Find a user with the Enterprise and 2FA badges.
- Select More actions ({ellipsis_v}) and select Disable two-factor authentication.
Prevent users from creating groups and projects outside the corporate group
A SAML identity administrator can configure the SAML response to set:
- Whether users can create groups.
- The maximum number of personal projects users can create.
For more information, see the supported user attributes for SAML responses.
Bypass email confirmation for provisioned users
A top-level group Owner can set up verified domains to bypass confirmation emails.
Get users' email addresses through the API
A top-level group Owner can use the group and project members API to access users' information, including email addresses.