Skip to content
Draft
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
83 changes: 50 additions & 33 deletions content/manuals/admin/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -35,63 +35,80 @@
- /docker-hub/admin-overview
---

Administrators can manage companies and organizations using the
[Docker Admin Console](https://app.docker.com/admin). The Admin Console
provides centralized observability, access management, and security controls
across Docker environments.
Administrators start with the [Docker Admin Console](https://app.docker.com/admin) to provision user seats, manage access tokens, SSO and SCIM, and deploy Docker Desktop to their organizations.

## Set up Docker with Admin Console

Administrators get started with Docker by accessing the Admin Console to create a company and organizations.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Administrators get started with Docker by accessing the Admin Console to create a company and organizations.
Administrators use the Admin Console to create a company and organizations.


- If you're a Docker Business subscriber, you have access to both company and organization features.
- If you're Docker Team subscriber, you have access to organization features in Admin Console.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- If you're Docker Team subscriber, you have access to organization features in Admin Console.
- If you're Docker Team subscriber, you have access to organization features.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Idk if it makes sense to describe the differences between company/organization ownership as a feature set. It seems like the biggest meaningful difference is that you can provision across multiple orgs if you have the company lvl, should check


As an administrator, you're an owner who can invite users with their email addresses, then assign them member roles to particular teams.

## Company and organization hierarchy

The [Docker Admin Console](https://app.docker.com/admin) provides administrators with centralized observability, access management, and controls for their company and organizations. To provide these features, Docker uses the following hierarchy and roles.
Admin Console gives administrators a bird's eye overview of a company and its downstream organizations. Company and organizations have a hierarchical relationship:

Check failure on line 51 in content/manuals/admin/_index.md

View workflow job for this annotation

GitHub Actions / validate (vale)

[vale] reported by reviewdog 🐶 [Docker.Spacing] ' ' should have one space. Raw Output: {"message": "[Docker.Spacing] ' ' should have one space.", "location": {"path": "content/manuals/admin/_index.md", "range": {"start": {"line": 51, "column": 70}}}, "severity": "ERROR"}

![Diagram showing Docker’s administration hierarchy with Company at the top, followed by Organizations, Teams, and Members](./images/docker-admin-structure.webp)

Administrators can occupy company owner or organization owner roles (or both), where each role has its own permissions and seat rules.

- Company owners can view and bulk edit settings and configurations for all organizations beneath them.
- Organization owners have full admin permissions to manage settings, members, roles, and teams within their organization, but not organizations they're not part of.

When an administrator creates the first company from Admin Console, they assume owner roles pursuant to their subscription type. For example:

- A Docker Business subscriber assumes owner permissions for both the first company and first organization.
- A Docker Team subscriber assumes owner permissions for the first created organization.

### Company

A company groups multiple Docker organizations for centralized configuration.
Companies are only available for Docker Business subscribers.
The highest level of visibility an administrator can have is at the company level. A company owner views and manages all organizations within the company and has full access to company-wide settings.

Company owners won't occupy a seat unless one of the following is true:

Companies have the following administrator role available:
- They are added as a member of an organization under your company.
- SSO is enabled.

- Company owner: Can view and manage all organizations within the company.
Has full access to company-wide settings and inherits the same permissions as
organization owners.
If you're a Docker team subscribe who wants access to company-level permissions, you can [upgrade to Docker Business](/subscription/change/#upgrade-your-subscription).

Check failure on line 74 in content/manuals/admin/_index.md

View workflow job for this annotation

GitHub Actions / validate (vale)

[vale] reported by reviewdog 🐶 [Vale.Terms] Use 'Docker Team' instead of 'Docker team'. Raw Output: {"message": "[Vale.Terms] Use 'Docker Team' instead of 'Docker team'.", "location": {"path": "content/manuals/admin/_index.md", "range": {"start": {"line": 74, "column": 13}}}, "severity": "ERROR"}

### Organization

An organization contains teams and repositories. All Docker Team and Business
subscribers must have at least one organization.
subscribers must create one organization before inviting new members to Docker.

Organizations have the following administrator role available:
Organization owners manage organization settings, users, and access controls. All organizations owners occupy at least one seat, but can occupy more than one seat if they're members or owners of multiple, separate organizations.

- Organization owner: Can manage organization settings, users, and access
controls.
## Seats and user management

### Team
The number of seats an administrator can provision depends on their [subscription type](https://www.docker.com/pricing/). Once you've decided on a plan and created your first company or organization, you can send invitations to future members.

Teams are optional and let you group members to assign repository permissions
collectively. Teams simplify permission management across projects
or functions.
### Seats

### Member
A seat is a unit purchased with a subscription plan that extends access to users to an organization's repo.

Check warning on line 89 in content/manuals/admin/_index.md

View workflow job for this annotation

GitHub Actions / validate (vale)

[vale] reported by reviewdog 🐶 [Docker.RecommendedWords] Consider using 'repository' instead of 'repo' Raw Output: {"message": "[Docker.RecommendedWords] Consider using 'repository' instead of 'repo'", "location": {"path": "content/manuals/admin/_index.md", "range": {"start": {"line": 89, "column": 103}}}, "severity": "INFO"}

Check failure on line 89 in content/manuals/admin/_index.md

View workflow job for this annotation

GitHub Actions / validate (vale)

[vale] reported by reviewdog 🐶 [Vale.Spelling] Did you really mean 'repo'? Raw Output: {"message": "[Vale.Spelling] Did you really mean 'repo'?", "location": {"path": "content/manuals/admin/_index.md", "range": {"start": {"line": 89, "column": 103}}}, "severity": "ERROR"}

A member is any Docker user added to an organization. Organization and company
owners can assign roles to members to define their level of access.
- They give administrators granular permissions around who can contribute to a repository.
- They prevent unauthorized users from pushing to a repos they're not members of.

> [!NOTE]
>
> Creating a company is optional, but organizations are required for Team and
Business subscriptions.
For example, an organization owner takes up one seat. They can invite Docker users to an organization. Once invitees become members, organization owners can set permissions in bulk or on an individual basis to repositories affiliated with an organization.

## Admin Console features
### Users and members

Docker's [Admin Console](https://app.docker.com/admin) allows you to:
Docker uses specific terminology to define the kind of access a Docker user has:

- Create and manage companies and organizations
- Assign roles and permissions to members
- Group members into teams to manage access by project or role
- Set company-wide policies, including SCIM provisioning and security
enforcement
- A user is someone with a Docker ID.
- They are not necessarily affiliated with an organization.
- They do not take up seats by default.
- An invitee is a user invited to an organization.
- Invitees occupy one seat.
- This is a user state before accepting and joining an organization.
- A member is a user who accepted an invitation to an organization.
- Teams let you group members together.
- They are optional.
- They allow you to assign repository permissions in bulk.
- Teams can simplify permission management across projects
or functions.

## Manage companies and organizations

Expand Down
Loading