How to Invite and Grant Access to a User Using IAM in a Vultr Organization

Identity and Access Management (IAM) in Vultr controls which users can access an organization and what actions they can perform on its resources. An organization grants access through a chain of components. Users join the organization, groups collect users with similar responsibilities, and policies attached to those groups (directly or through roles) define the specific permissions each member receives.

This guide explains how to invite a new organization member and grant them access. It covers sending the invitation, creating a group, attaching a managed policy to the group, confirming the user's acceptance, adding the user to the group, and validating the user's access. It also explains why a newly invited user can see a No Active Organization screen on first login, and how to avoid that outcome.

Prerequisites

Before you begin, you need to:

• Have access to a Vultr account with an existing organization.
• Be the organization's root user, or have an account with iam.group.*, iam.policy.*, and iam.invitation.* permissions.
• Have the Vultr API key for your organization, required for the effective access check at the end of this guide.
• Know the email address of the person you want to add to the organization.

Understand the Access Model

Joining an organization does not, by itself, grant a user any permissions. If an invitation goes out with no role, group, or policy selected, the user joins the organization with no assigned access, and the Vultr Console displays a blank No Active Organization screen when they log in. To let a user view or manage resources, attach a policy to them, either directly, through a role, or through a group. Without an attached policy, the user account exists in the organization but cannot access any of its resources.

Organization
  └── User (invited, status: Pending)
  └── Group (created)
        └── Policy (attached to the group)
  └── User accepts invite (status: Active)
  └── User added to Group

Invite the User to the Organization

Inviting a user sends them an email invitation to join the organization. The invitation only grants organization membership. It does not, by itself, grant any permissions.

1. Log in to the Vultr Console.

2. Click the organization name in the top navigation bar.

3. Click Manage Organization.

4. Click the Users tab.

5. Click the Add User button.

6. In the Add User panel, select the Invite Type as User.

7. Enter the user's Email Address.

8. Click Review and Invite.

9. Review the invitation details and click Send Invitation.

   The invitation is sent to the user's email address. The user appears in the Invitations section with a status of Invite Pending until they accept.

For more detail on this step, including the Vultr API method, refer to How to Invite a User to an Organization.

Create a Group for the User's Role

A group lets you assign permissions once and apply them to every member, instead of repeating the same policy and role attachments for each individual user.

1. Click the Groups tab in Manage Organization.

2. Click the + button to add a group.

3. Enter the Group Name and Group Description.

4. Click Review.

5. Review the details and click Add Group.

   The group is created and appears in the Groups list with no members and no attached policies yet.

For more detail on this step, including the Vultr API method, refer to How to Create a Group.

Attach a Managed Policy to the Group

Vultr provides a set of managed policies covering common access patterns, so you do not need to write a policy document from scratch for standard roles. Attaching a managed policy grants every current and future member of the group the permissions it defines.

1. Click the Permission Policies tab in Manage Organization.

2. Select a managed policy that matches the access level the user needs.

3. In the Attached Entities section, click the + button.

4. Search for and select the group you created.

5. Click Attach Entities.

   The group appears in the Attached Entities list, and all current and future members inherit the policy's permissions.

For more detail on this step, including the Vultr API method, refer to How to Attach a Policy to a Group.

Confirm Invitation Acceptance

A user must hold an Active status before you can add them to a group. Confirm that the user accepted the invitation before moving on to the next step.

1. Click the Users tab in Manage Organization.

2. Locate the invited user in the list.

   Verify that the status changes from Invite Pending to Active. Status updates as soon as the user accepts the invitation.

Add the User to the Group

Adding the user to the group connects their organization membership to the permissions attached to the group in the earlier step.

1. Click the Users tab in Manage Organization.

2. Click the name of the now-active user.

3. In the Groups section, click the + icon.

4. In the Add to Groups panel, select the group you created.

5. Click Add User to Groups.

   The user immediately inherits the group's permissions.

For more detail on this step, including the Vultr API method, refer to How to Add a User to a Group.

Understand the "No Active Organization" Screen

A user who accepts an organization invitation and logs in before being added to any group, and without a role or policy attached directly, has a valid membership but zero permissions. The Vultr Console responds to this state by displaying a No Active Organization screen on the organization page, with the message "We currently do not have your organization details", because the user has nowhere to navigate, even though the invitation itself succeeded.

This is the most common point of confusion in user provisioning. The user successfully joined the organization, but the lack of any assigned access makes the Console behave as if no organization is available to them. If a user reports a No Active Organization screen after accepting an invite, verify the following items.

• The user's status in the Users tab shows Active, not Invite Pending.
• The user belongs to at least one group that has a policy attached, or has a role or policy attached directly.

Validate the User's Effective Access

Effective access combines every policy a user receives directly, through a role, and through group membership. Validating it confirms that the group and policy configured earlier actually reach the user, rather than relying on the individual attachment steps alone. The Vultr Console has no screen for this check, so use the Vultr API.

Send a GET request to the List Current User's Groups endpoint using an API key scoped to the newly provisioned user.

$ curl "https://api.vultr.com/v2/users/me/groups" \
    -X GET \
    -H "Authorization: Bearer ${VULTR_API_KEY}"

The response contains the group you added the user to. If the response is empty, recheck the group membership and the policy attachment, because an empty result on this endpoint is what produces the No Active Organization screen for that user.

Conclusion

You have invited a new member to your organization and given them working access through a managed policy attached to a group. The member can view and manage the resources their policy permits, without encountering a No Active Organization screen on login. For more information, refer to the Vultr IAM documentation.