From 6ea8b4ca73cd62708b8301f23eb2f6df42300246 Mon Sep 17 00:00:00 2001 From: ldecarvalho-doc <82805470+ldecarvalho-doc@users.noreply.github.com> Date: Thu, 5 Jun 2025 12:04:31 +0200 Subject: [PATCH 1/8] fix(iam): phase 3 --- .../guests-to-members-migration.mdx | 63 +++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 pages/iam/reference-content/guests-to-members-migration.mdx diff --git a/pages/iam/reference-content/guests-to-members-migration.mdx b/pages/iam/reference-content/guests-to-members-migration.mdx new file mode 100644 index 0000000000..e9cd5a73d3 --- /dev/null +++ b/pages/iam/reference-content/guests-to-members-migration.mdx @@ -0,0 +1,63 @@ +--- +meta: + title: IAM Guests to Members migration + description: Learn how Scaleway has migrated features including roles and API keys with the introduction of IAM +content: + h1: IAM Migration + paragraph: Learn how Scaleway has migrated features including roles and API keys with the introduction of IAM +tags: iam +categories: + - iam + - console +--- + +This document explains how user management changes with the migration of IAM Guests to Members. + +## IAM Users + +A user (also known as an IAM user) is a human user in an Organization. Three types currently exist: + +- **Owner**: You are the Owner of the [Organization](#organization) that was created with your account. +- **Guest**: You are a Guest when invited to another Organization of which you are not the Owner. +- **Member**: You are a Member when you are added to an Organization by an Owner or user with IAM Manager permissions. Members exist only within the specific Organizations in which they are created. + +Whereas Owners have full rights and access to all resources and features in their Organization, Guests and Members have only the rights and permissions given to them via [policies](#policy). + +## IAM Guests become IAM Members + +From June 2025, IAM Guests will become IAM Members. The migration process will be carried out in two phases: + + - **Phase 1** - Starting on the *18th of July 2025*, the [manual migration of Guests]() will be available in the Console to all Owners and users with [IAMManager permissions](/iam/reference-content/permission-sets) until + - **Phase 2** - Starting in *July 2025*, Guests that have not yet become members will be automatically migrated. + +### What changes? + +The table below summarizes the key account and access management features that Scaleway offered prior to IAM, and if/how they change with the introduction of Members. For more information, see the relevant sections of this document below. + +| Feature | Guests | Members | +|:--------:|:---------:|:---------:| +| Login | Guests logged into their own accounts and could access all Organizations they were a part of via the console. | Currently, Members must log into their Organizations to access it. If they are logged into a different Organization with the same email, they must log out before logging into the other. | +| Enforcement of MFA | It was not possible to enforce MFA if a Guest in your Organization had not enabled MFA in their account. Organization admins could send reminder emails, but had to wait for the Guest to enable MFA, or remove them from the Organization to complete the enforce process. | When MFA is enforced in the Organization, Members have a [grace period](iam/concepts/#grace-period) to enable MFA in their accounts. This period is set by the Organization admins and starts as soon as a new Member is added. If they fail to enable MFA within this period, their accounts are locked. | +| Password renewal | Guests were not required to renew their passwords to stay in an Organization. | As a security measure, Organization admins can require Members to renew their passwords within a grace period. If a password was attributed to Members upon their creation, they must renew this password after their first login. | +| User management | Guest accounts and personal Organizations could not be managed by anyone other than them. Their permissions on Organizations they were invited to are the prerogative of Organization admins. | Member accounts are an 100% manageable resource - they can be created, updated, locked and deleted by Organization admins. | +| Organizations | Guests were users who had their own personal Organizations and were invited into another. They had full management rights on their accounts and Organizations. If they were removed from an Organization, they would continue to have a Scaleway account. | Members exist only within an Organization and can be present in solely said Organization. Members cannot own Organizations. They must [comply to the security requirements](/iam/how-to/comply-with-sec-requirements-member) set for the Organization to ensure their continuous access. | + + +### What remains the same? + +| Feature | Guests | Members | +|:--------:|:-------:|----------| +| Single Sign-On (SSO) | Available | Available | +| Credentials (Password, SSO, MFA) | - | Members who previously existed as Guests maintain the same credentials configuration as before. | +| Access control | - | Like Guests, Members are granted permissions to the Organization by way of IAM policies. | +| API keys | - | The processes for creating, viewing and deleting API keys remain the same. | + + +## How to manually migrate a user from Guest to Member + + + The migration does not effect any impacts to your production. + + + + From be098baa645ce7fa3144ff9c2793d00f92d1e0f0 Mon Sep 17 00:00:00 2001 From: ldecarvalho-doc <82805470+ldecarvalho-doc@users.noreply.github.com> Date: Thu, 5 Jun 2025 13:41:37 +0200 Subject: [PATCH 2/8] fix(iam): first part --- .../iam/reference-content/guests-to-members-migration.mdx | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pages/iam/reference-content/guests-to-members-migration.mdx b/pages/iam/reference-content/guests-to-members-migration.mdx index e9cd5a73d3..b84ad3d890 100644 --- a/pages/iam/reference-content/guests-to-members-migration.mdx +++ b/pages/iam/reference-content/guests-to-members-migration.mdx @@ -1,11 +1,11 @@ --- meta: title: IAM Guests to Members migration - description: Learn how Scaleway has migrated features including roles and API keys with the introduction of IAM + description: Learn how to migrate IAM guests to members, including roles and API keys, with Scaleway's IAM introduction content: - h1: IAM Migration - paragraph: Learn how Scaleway has migrated features including roles and API keys with the introduction of IAM -tags: iam + h1: IAM Guests to Members Migration + paragraph: This page guides you through the process of migrating IAM guests to members, covering key aspects such as roles and API keys, following the introduction of IAM on Scaleway +tags: iam migration categories: - iam - console From e824cce09d6032bcd18264eccab905a6c48a46ad Mon Sep 17 00:00:00 2001 From: ldecarvalho-doc <82805470+ldecarvalho-doc@users.noreply.github.com> Date: Thu, 5 Jun 2025 14:05:01 +0200 Subject: [PATCH 3/8] fix(iam): add procedure --- .../guests-to-members-migration.mdx | 50 +++++++++++++------ 1 file changed, 36 insertions(+), 14 deletions(-) diff --git a/pages/iam/reference-content/guests-to-members-migration.mdx b/pages/iam/reference-content/guests-to-members-migration.mdx index b84ad3d890..9670625fa5 100644 --- a/pages/iam/reference-content/guests-to-members-migration.mdx +++ b/pages/iam/reference-content/guests-to-members-migration.mdx @@ -27,9 +27,25 @@ Whereas Owners have full rights and access to all resources and features in thei From June 2025, IAM Guests will become IAM Members. The migration process will be carried out in two phases: - - **Phase 1** - Starting on the *18th of July 2025*, the [manual migration of Guests]() will be available in the Console to all Owners and users with [IAMManager permissions](/iam/reference-content/permission-sets) until + - **Phase 1** - Starting on the *18th of July 2025*, the [manual migration of Guests](#how-to-manually-migrate-a-user-from-guest-to-member) will be available in the Console to all Owners and users with [IAMManager permissions](/iam/reference-content/permission-sets). - **Phase 2** - Starting in *July 2025*, Guests that have not yet become members will be automatically migrated. +Keep in mind that: + +- Members exist only within the Organizations in which they were created, and have a [dedicated login process](/iam/how-to/log-in-as-a-member). +- Organization admins manage Member accounts, including enforcing security requirements (MFA, password renewal). +- Single Sign-On (SSO) remains available. +- The management of API keys, IAM policies, and groups remains the same. + +### What remains the same? + +| Feature | for Members | +|:--------:|----------| +| Single Sign-On (SSO) | Available | +| Credentials (Password, SSO, MFA) | Members who previously existed as Guests maintain the same credentials configuration as before. | +| Access control | Like Guests, Members are granted permissions to the Organization by way of IAM policies. | +| API keys | The processes for creating, viewing and deleting API keys remain the same. | + ### What changes? The table below summarizes the key account and access management features that Scaleway offered prior to IAM, and if/how they change with the introduction of Members. For more information, see the relevant sections of this document below. @@ -42,22 +58,28 @@ The table below summarizes the key account and access management features that S | User management | Guest accounts and personal Organizations could not be managed by anyone other than them. Their permissions on Organizations they were invited to are the prerogative of Organization admins. | Member accounts are an 100% manageable resource - they can be created, updated, locked and deleted by Organization admins. | | Organizations | Guests were users who had their own personal Organizations and were invited into another. They had full management rights on their accounts and Organizations. If they were removed from an Organization, they would continue to have a Scaleway account. | Members exist only within an Organization and can be present in solely said Organization. Members cannot own Organizations. They must [comply to the security requirements](/iam/how-to/comply-with-sec-requirements-member) set for the Organization to ensure their continuous access. | - -### What remains the same? - -| Feature | Guests | Members | -|:--------:|:-------:|----------| -| Single Sign-On (SSO) | Available | Available | -| Credentials (Password, SSO, MFA) | - | Members who previously existed as Guests maintain the same credentials configuration as before. | -| Access control | - | Like Guests, Members are granted permissions to the Organization by way of IAM policies. | -| API keys | - | The processes for creating, viewing and deleting API keys remain the same. | - - ## How to manually migrate a user from Guest to Member The migration does not effect any impacts to your production. - - + + +- A Scaleway account logged into the [console](https://console.scaleway.com) +- [Owner](/iam/concepts/#owner) status or [IAMManager permissions](/iam/concepts/#permission) + +1. Click **IAM & API keys** on the top-right drop-down menu of the Scaleway console. The **Users** tab of the [Identity and Access Management dashboard](https://console.scaleway.com/iam/users) displays. +2. Click **Switch to Members** in the *Switch to IAM Members* top banner. A pop-up appears providing information about Member features. +3. Click **Next**. More information about the changes for your users displays. +4. Click **Next** again. +5. Type **MIGRATE**. + + Make sure you are sure of migrating before continuing. Switching to Members is a one-time irreversible action. + +6. Click **Migrate**. + + The migration might take up to one minute. + + +You receive an email to confirm the migration. The former Guests, now Members, also receive an email with their credentials instructions on how to log in as a member for the first time. \ No newline at end of file From b0dbab92d36852055070072f7b470a3a089a1a37 Mon Sep 17 00:00:00 2001 From: ldecarvalho-doc <82805470+ldecarvalho-doc@users.noreply.github.com> Date: Thu, 5 Jun 2025 14:08:01 +0200 Subject: [PATCH 4/8] fix(iam): add menu --- menu/navigation.json | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/menu/navigation.json b/menu/navigation.json index cec58c8877..a94bcaeb87 100644 --- a/menu/navigation.json +++ b/menu/navigation.json @@ -414,6 +414,10 @@ "label": "Permission sets", "slug": "permission-sets" }, + { + "label": "IAM Guests to Members migration", + "slug": "guests-to-members-migration" + }, { "label": "Reproducing roles and Project-scoped API keys with IAM", "slug": "reproduce-roles-project-api-keys" From 128ac659f6dd727a89f63c32ee5ba91b45316971 Mon Sep 17 00:00:00 2001 From: ldecarvalho-doc <82805470+ldecarvalho-doc@users.noreply.github.com> Date: Thu, 5 Jun 2025 14:50:33 +0200 Subject: [PATCH 5/8] fix(iam): review ro Co-authored-by: Rowena Jones <36301604+RoRoJ@users.noreply.github.com> --- .../reference-content/guests-to-members-migration.mdx | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/pages/iam/reference-content/guests-to-members-migration.mdx b/pages/iam/reference-content/guests-to-members-migration.mdx index 9670625fa5..47b348645e 100644 --- a/pages/iam/reference-content/guests-to-members-migration.mdx +++ b/pages/iam/reference-content/guests-to-members-migration.mdx @@ -1,10 +1,10 @@ --- meta: title: IAM Guests to Members migration - description: Learn how to migrate IAM guests to members, including roles and API keys, with Scaleway's IAM introduction + description: Learn how to migrate IAM Guests to Members, including roles and API keys, with Scaleway's IAM introduction content: h1: IAM Guests to Members Migration - paragraph: This page guides you through the process of migrating IAM guests to members, covering key aspects such as roles and API keys, following the introduction of IAM on Scaleway + paragraph: This page guides you through the process of migrating IAM Guests to Members, covering key aspects such as roles and API keys, following the introduction of IAM on Scaleway tags: iam migration categories: - iam @@ -28,11 +28,12 @@ Whereas Owners have full rights and access to all resources and features in thei From June 2025, IAM Guests will become IAM Members. The migration process will be carried out in two phases: - **Phase 1** - Starting on the *18th of July 2025*, the [manual migration of Guests](#how-to-manually-migrate-a-user-from-guest-to-member) will be available in the Console to all Owners and users with [IAMManager permissions](/iam/reference-content/permission-sets). - - **Phase 2** - Starting in *July 2025*, Guests that have not yet become members will be automatically migrated. + - **Phase 2** - Starting in *July 2025*, Guests that have not yet become Members will be automatically migrated. Keep in mind that: - Members exist only within the Organizations in which they were created, and have a [dedicated login process](/iam/how-to/log-in-as-a-member). +- Migrating a Guest to a Member does not mean that the Guest loses the Organization of which they are Owner. However, when creating Members in the future who do not already have Scaleway accounts, they will not be obliged to create their own Organization. - Organization admins manage Member accounts, including enforcing security requirements (MFA, password renewal). - Single Sign-On (SSO) remains available. - The management of API keys, IAM policies, and groups remains the same. @@ -52,7 +53,7 @@ The table below summarizes the key account and access management features that S | Feature | Guests | Members | |:--------:|:---------:|:---------:| -| Login | Guests logged into their own accounts and could access all Organizations they were a part of via the console. | Currently, Members must log into their Organizations to access it. If they are logged into a different Organization with the same email, they must log out before logging into the other. | +| Login | Guests logged into their own accounts and could access all Organizations they were a part of via the console. | Currently, Members must log into each of their Organizations separately to access them. If they log into an Organization, then want to access a different one using the same email, they must log out of the former first. | | Enforcement of MFA | It was not possible to enforce MFA if a Guest in your Organization had not enabled MFA in their account. Organization admins could send reminder emails, but had to wait for the Guest to enable MFA, or remove them from the Organization to complete the enforce process. | When MFA is enforced in the Organization, Members have a [grace period](iam/concepts/#grace-period) to enable MFA in their accounts. This period is set by the Organization admins and starts as soon as a new Member is added. If they fail to enable MFA within this period, their accounts are locked. | | Password renewal | Guests were not required to renew their passwords to stay in an Organization. | As a security measure, Organization admins can require Members to renew their passwords within a grace period. If a password was attributed to Members upon their creation, they must renew this password after their first login. | | User management | Guest accounts and personal Organizations could not be managed by anyone other than them. Their permissions on Organizations they were invited to are the prerogative of Organization admins. | Member accounts are an 100% manageable resource - they can be created, updated, locked and deleted by Organization admins. | @@ -61,7 +62,7 @@ The table below summarizes the key account and access management features that S ## How to manually migrate a user from Guest to Member - The migration does not effect any impacts to your production. + The migration does not have any impact on your production. From 43275cd16ce5bc877e8935db36a486780503c7d3 Mon Sep 17 00:00:00 2001 From: ldecarvalho-doc <82805470+ldecarvalho-doc@users.noreply.github.com> Date: Wed, 18 Jun 2025 10:00:26 +0200 Subject: [PATCH 6/8] fix(iam): reviews Co-authored-by: Nathanael Demacon <7271496+quantumsheep@users.noreply.github.com> --- .../iam/reference-content/guests-to-members-migration.mdx | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pages/iam/reference-content/guests-to-members-migration.mdx b/pages/iam/reference-content/guests-to-members-migration.mdx index 47b348645e..eec0fe57d9 100644 --- a/pages/iam/reference-content/guests-to-members-migration.mdx +++ b/pages/iam/reference-content/guests-to-members-migration.mdx @@ -1,10 +1,10 @@ --- meta: title: IAM Guests to Members migration - description: Learn how to migrate IAM Guests to Members, including roles and API keys, with Scaleway's IAM introduction + description: Learn how to migrate IAM Guests to Members content: h1: IAM Guests to Members Migration - paragraph: This page guides you through the process of migrating IAM Guests to Members, covering key aspects such as roles and API keys, following the introduction of IAM on Scaleway + paragraph: This page guides you through the process of migrating IAM Guests to Members tags: iam migration categories: - iam @@ -56,8 +56,8 @@ The table below summarizes the key account and access management features that S | Login | Guests logged into their own accounts and could access all Organizations they were a part of via the console. | Currently, Members must log into each of their Organizations separately to access them. If they log into an Organization, then want to access a different one using the same email, they must log out of the former first. | | Enforcement of MFA | It was not possible to enforce MFA if a Guest in your Organization had not enabled MFA in their account. Organization admins could send reminder emails, but had to wait for the Guest to enable MFA, or remove them from the Organization to complete the enforce process. | When MFA is enforced in the Organization, Members have a [grace period](iam/concepts/#grace-period) to enable MFA in their accounts. This period is set by the Organization admins and starts as soon as a new Member is added. If they fail to enable MFA within this period, their accounts are locked. | | Password renewal | Guests were not required to renew their passwords to stay in an Organization. | As a security measure, Organization admins can require Members to renew their passwords within a grace period. If a password was attributed to Members upon their creation, they must renew this password after their first login. | -| User management | Guest accounts and personal Organizations could not be managed by anyone other than them. Their permissions on Organizations they were invited to are the prerogative of Organization admins. | Member accounts are an 100% manageable resource - they can be created, updated, locked and deleted by Organization admins. | -| Organizations | Guests were users who had their own personal Organizations and were invited into another. They had full management rights on their accounts and Organizations. If they were removed from an Organization, they would continue to have a Scaleway account. | Members exist only within an Organization and can be present in solely said Organization. Members cannot own Organizations. They must [comply to the security requirements](/iam/how-to/comply-with-sec-requirements-member) set for the Organization to ensure their continuous access. | +| User management | Guest accounts and personal Organizations could not be managed by anyone other than them. Their permissions on Organizations they were invited to are the prerogative of Organization admins. | Member accounts are a 100% manageable resource - they can be created, updated, locked and deleted by Organization admins. | +| Organizations | Guests were users who had their own personal Organizations and were invited into another. They had full management rights on their accounts and Organizations. If they were removed from an Organization, they would continue to have a Scaleway account. | Members exist only within an Organization and they exist solely in that Organization. Members cannot own Organizations. They must [comply with the security requirements](/iam/how-to/comply-with-sec-requirements-member) set for the Organization to ensure their continuous access. | ## How to manually migrate a user from Guest to Member From 9bbe26de89cadf5e838f2670c442b4019f92c7cb Mon Sep 17 00:00:00 2001 From: ldecarvalho-doc <82805470+ldecarvalho-doc@users.noreply.github.com> Date: Wed, 18 Jun 2025 14:12:39 +0200 Subject: [PATCH 7/8] fix(iam): add note --- .../reference-content/guests-to-members-migration.mdx | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/pages/iam/reference-content/guests-to-members-migration.mdx b/pages/iam/reference-content/guests-to-members-migration.mdx index eec0fe57d9..b197bf15b6 100644 --- a/pages/iam/reference-content/guests-to-members-migration.mdx +++ b/pages/iam/reference-content/guests-to-members-migration.mdx @@ -18,7 +18,7 @@ This document explains how user management changes with the migration of IAM Gue A user (also known as an IAM user) is a human user in an Organization. Three types currently exist: - **Owner**: You are the Owner of the [Organization](#organization) that was created with your account. -- **Guest**: You are a Guest when invited to another Organization of which you are not the Owner. +- **Guest**: You are a Guest when invited to another Organization of which you are not the Owner. All guests have a different Scaleway Organization of their own. - **Member**: You are a Member when you are added to an Organization by an Owner or user with IAM Manager permissions. Members exist only within the specific Organizations in which they are created. Whereas Owners have full rights and access to all resources and features in their Organization, Guests and Members have only the rights and permissions given to them via [policies](#policy). @@ -53,7 +53,7 @@ The table below summarizes the key account and access management features that S | Feature | Guests | Members | |:--------:|:---------:|:---------:| -| Login | Guests logged into their own accounts and could access all Organizations they were a part of via the console. | Currently, Members must log into each of their Organizations separately to access them. If they log into an Organization, then want to access a different one using the same email, they must log out of the former first. | +| Login | Guests logged into their own accounts and could access all Organizations they were a part of via the console. | Members are identified by email address. If you are a Member in more than one Organization with the same email address, you can switch between Organizations. You must perform a first connection as a Member to remain connected and easily switch between Organizations. A first login is required for each device you use to connect to the Scaleway console. You remain logged into each device unless you clear your cookies. | | Enforcement of MFA | It was not possible to enforce MFA if a Guest in your Organization had not enabled MFA in their account. Organization admins could send reminder emails, but had to wait for the Guest to enable MFA, or remove them from the Organization to complete the enforce process. | When MFA is enforced in the Organization, Members have a [grace period](iam/concepts/#grace-period) to enable MFA in their accounts. This period is set by the Organization admins and starts as soon as a new Member is added. If they fail to enable MFA within this period, their accounts are locked. | | Password renewal | Guests were not required to renew their passwords to stay in an Organization. | As a security measure, Organization admins can require Members to renew their passwords within a grace period. If a password was attributed to Members upon their creation, they must renew this password after their first login. | | User management | Guest accounts and personal Organizations could not be managed by anyone other than them. Their permissions on Organizations they were invited to are the prerogative of Organization admins. | Member accounts are a 100% manageable resource - they can be created, updated, locked and deleted by Organization admins. | @@ -83,4 +83,8 @@ The table below summarizes the key account and access management features that S The migration might take up to one minute. -You receive an email to confirm the migration. The former Guests, now Members, also receive an email with their credentials instructions on how to log in as a member for the first time. \ No newline at end of file +You receive an email to confirm the migration. The former Guests, now Members, also receive an email with their credentials instructions on how to log in as a member for the first time. + + + If you are a Member in more than one Organization with the same email address, you can switch between Organizations. You must perform a first connection as a Member to remain connected and easily switch between Organizations. A first login is required for each device you use to connect to the Scaleway console. You remain logged into each device unless you clear your cookies. + From 7ddb53586c5b990de22bd72b5cf15baa83f6cb05 Mon Sep 17 00:00:00 2001 From: ldecarvalho-doc <82805470+ldecarvalho-doc@users.noreply.github.com> Date: Thu, 19 Jun 2025 16:53:35 +0200 Subject: [PATCH 8/8] fix(iam): bye bye guests --- pages/account/how-to/manage-notifications.mdx | 2 +- pages/billing/how-to/add-billing-contact.mdx | 7 +++---- pages/iam/concepts.mdx | 12 ------------ pages/organizations-and-projects/concepts.mdx | 2 +- .../how-to/enforce-mfa.mdx | 11 +---------- 5 files changed, 6 insertions(+), 28 deletions(-) diff --git a/pages/account/how-to/manage-notifications.mdx b/pages/account/how-to/manage-notifications.mdx index 40840c87dc..3dc4e0dd5d 100644 --- a/pages/account/how-to/manage-notifications.mdx +++ b/pages/account/how-to/manage-notifications.mdx @@ -26,7 +26,7 @@ The **notification manager** allows you to configure different types of notifica 2. Scroll to the **User notifications** section. 3. Check the box(es) next to the email of the user for who you want to set up the notifications. Four [types of notifications](#types-of-notifications) are available: **Incident**, **Technical**, **Security** and **Billing**. - The emails displayed in the list belong to users in your Organization. To see them in the list, first you must have either [invited them as a Guest](/iam/how-to/invite-user-to-orga/), or [created a new Member](/iam/how-to/manage-members/#how-to-create-a-member). + The emails displayed in the list belong to users in your Organization. To see them in the list, first you must [created a new Member](/iam/how-to/manage-members/#how-to-create-a-member). When you check the box, the user is automatically subscribed to the notifications. diff --git a/pages/billing/how-to/add-billing-contact.mdx b/pages/billing/how-to/add-billing-contact.mdx index 0ac25e087b..ae1d280974 100644 --- a/pages/billing/how-to/add-billing-contact.mdx +++ b/pages/billing/how-to/add-billing-contact.mdx @@ -24,10 +24,9 @@ When you enable billing notifications for a user they will receive your Organiza ## How to set up notifications for internal users -1. Add the intended billing contact as an IAM user. You can: - - [Invite them as a Guest](/iam/how-to/invite-user-to-orga/), or - - [Create a new Member](/iam/how-to/manage-members/#how-to-create-a-member). -2. Follow the steps described in the "How to notify users in your Organization" section of the [How to manage notifications](/account/how-to/manage-notifications/#how-to-notify-users-in-your-organization) documentation page. +1. Add the intended billing contact as an IAM user. +2. [Create a new Member](/iam/how-to/manage-members/#how-to-create-a-member). +3. Follow the steps described in the "How to notify users in your Organization" section of the [How to manage notifications](/account/how-to/manage-notifications/#how-to-notify-users-in-your-organization) documentation page. ## How to set up notifications for external users diff --git a/pages/iam/concepts.mdx b/pages/iam/concepts.mdx index 04044992ca..66e958ac48 100644 --- a/pages/iam/concepts.mdx +++ b/pages/iam/concepts.mdx @@ -48,14 +48,6 @@ The grace period is the time an [IAM Member](#members) has to comply with the se A group (also known as an IAM group) is a grouping of [users](#user) and/or [applications](#application). Creating groups allows you to attach [policies](#policy) to multiple users and/or applications at the same time. -## Guest - -You are the [Owner](#owner) of the Organization that is created with your Scaleway account. However, when you are invited to another Organization of which you are not the Owner, you are a **Guest** in that Organization. - - - Guests will be deprecated by July 2025. From then on, only Members can be created as users of your Organizations, and adding Guests to an Organization will no longer be possible. - - ## IAM **I**dentity and **A**ccess **M**anagement allows you to share access to the management of your Scaleway [resources](#resource) in a controlled and secure manner. @@ -157,10 +149,6 @@ Keep in mind that: A user (also known as an IAM user) is a human user in an Organization. They can be of two types: - **Owner**: You are the Owner of the [Organization](#organization) that was created with your account. -- **Guest**: You are a Guest when invited to another Organization of which you are not the Owner. - - Guests will be deprecated by July 2025. From then on, only Members can be created as users of your Organizations. - - **Member**: You are a Member when you are added to an Organization by an Owner or user with IAM Manager permissions. Members exist only within the specific Organizations in which they are created. Within each Organization, different IAM users can have different rights (defined through [policies](#policy)) to perform actions on resources. \ No newline at end of file diff --git a/pages/organizations-and-projects/concepts.mdx b/pages/organizations-and-projects/concepts.mdx index 53922816ae..9d2b407f1b 100644 --- a/pages/organizations-and-projects/concepts.mdx +++ b/pages/organizations-and-projects/concepts.mdx @@ -18,7 +18,7 @@ Each [Organization](#organization) has at least one associated [Project](#projec ## Organization -An Organization is made of one or several [Projects](#project). When you create your Scaleway account, an Organization is automatically created, of which you are the Owner. You can also be added to an existing Organization as a [Guest](#guest) or as a [Member](#member). +An Organization is made of one or several [Projects](#project). When you create your Scaleway account, an Organization is automatically created, of which you are the Owner. You can also be added to an existing Organization as a [Member](#member). When you create [IAM rules](#rule), you can set their scope at Organization level. This means you can give access to features managed at Organization level, like billing and IAM, to users, applications, and groups in your Organization. diff --git a/pages/organizations-and-projects/how-to/enforce-mfa.mdx b/pages/organizations-and-projects/how-to/enforce-mfa.mdx index 9cedfd5ac2..2390de6a5f 100644 --- a/pages/organizations-and-projects/how-to/enforce-mfa.mdx +++ b/pages/organizations-and-projects/how-to/enforce-mfa.mdx @@ -28,21 +28,12 @@ categories: 5. Type **ENFORCE** in the box. Keep in mind that: - - MFA will become mandatory for all users in the Organization. When you invite [Guests](/iam/concepts/#guest) to your Organization in the future, they must have set up MFA to be able to join.

- - You can only enforce MFA if all Guests in your Organization have already set up MFA on their accounts. + - MFA will become mandatory for all users in the Organization.

- If MFA is enforced in your Organization, all new [Members](/iam/concepts/#member) you create will have to enable MFA within the [grace period](/iam/concepts/#grace-period) you set. If they fail to do so before the grace period is over, their account will be locked. The same applies for existing members who do not yet have MFA enabled. Once you enforce MFA, they also have to comply with this [security requirement](/iam/how-to/enforce-security-requirements-members) within the grace period. 6. Click **Enforce MFA**. - If all users in your Organization already have enabled MFA, a confirmation message appears on the top right corner of the screen. - - If at least one of the Guests does not have MFA enabled, you must send them an [MFA reminder](#how-to-send-an-mfa-reminder). - -## How to send an MFA reminder - -1. Click **IAM & API keys** on the top-right drop-down menu of the Scaleway console. The **Users** tab displays. -2. Click > **Send MFA reminder** next to the name of a user that has MFA disabled. - The user will receive an email requesting that they enable MFA. - ## How to stop enforcing MFA