# Configure org roles

> This page is the **detail** for [Setup overview — Step 6: Configure org roles](/guides/user/b2b/b2b_setup-overview#step-6-configure-org-roles).
Assign role groups to each organization, so its members can receive the app roles those groups contain.


## Understand org roles

Continuing with the **[holiday booking platform](/guides/user/b2b/b2b_main-concepts)** example, you now have the organizations from the previous step and the role groups you already defined. The next decision is which role group each organization should receive.

In the main path of this guide, the **Retail travel agency** receives the broader **Retail storefront** role group, while **New York branch** receives the narrower **Retail sales only** role group exposed by the parent. This means head-office staff can receive a wider set of app roles, while branch staff remain limited to the branch-level scope.

This step also lets you decide whether an organization keeps the Mosaic application's default authentication settings or uses its own authentication override. In the example below, **Back-office / finance partner** is used only to show an organization that signs in through its own corporate identity system.

Organization
Assigned role group
Retail travel agency
Retail storefront
New York branch
Retail sales only
This step connects the previous setup decisions: the organizations you created now receive the role groups you defined earlier. Members of that organization will then be able to receive only the app roles those role groups allow.

## Configure role groups per organization and application

Role groups are assigned per **organization-application pair**: an organization connected to two applications can have a different set of role groups for each.

In the **Admin Portal**, go to **B2B Identity** > **Organizations** > [your org] > **Applications** tab > [your app] > **Settings** > **Members roles and groups** tab. Roles and role groups are defined at the application level: you select them here, but you can't create, edit, or delete them. To change the catalog itself, see [Define app roles](/guides/user/b2b/b2b_define_app_roles) and [Create app role groups](/guides/user/b2b/b2b_create_role_groups).

The tab has two lists:

- **Member role groups** — the role groups this organization can use for this application. Selecting a group also selects the member roles it contains.
- **Member roles** — the individual member roles available to the organization. Three organization-level roles are marked **(default)** and are always selected: **Organization admin**, **Managed Organization Creator**, and **Organization member**. They can't be cleared, so the organization always keeps the roles it needs to administer itself.


Selecting roles here makes them available to the organization; it doesn't give them to anyone. Members start with no roles at all, including the organization-level ones, and receive them individually — see [Set members](/guides/user/b2b/b2b_set_members).

Role groups and members
To assign member roles, role groups must already be assigned to the organization. If you haven’t created the required role groups yet, see [Create app role groups](/guides/user/b2b/b2b_create_role_groups).

### For parent–child hierarchies

When organizations are structured as parent and managed children, open the **Members roles and groups** tab for each org. What you select depends on which org you have open:

- **If it's a parent org**: assign the role groups you designated as parent role groups in [Step 4](/guides/user/b2b/b2b_create_role_groups#configure-parentchild-role-group-relationships) (e.g. **Retail storefront**).
- **If it's a managed child org**: assign the role groups you designated as child-facing role groups in Step 4 (e.g. **Retail sales only** for **New York branch**). These are the role groups exposed through **Managed (child) role groups** on the parent role groups assigned to that parent organization. The picker shows only the role groups the parent has exposed.


Order matters
Always assign role groups to the parent org before the managed child. The child org's picker is populated from what the parent has already been assigned — if the parent has no role groups yet, the picker will be empty.

## Associate an organization to multiple apps

An organization can be associated with more than one application. This lets you give the same organization access to different products or services on your platform. For example, the **Back-office / finance partner** is associated with the **Holiday booking platform** and could also be linked to a second application, with different role groups assigned for each.

Top-level organizations only
Managed child organizations are bound to a single application and cannot be associated with additional ones — see [What a managed child organization can and cannot do](/guides/user/b2b/b2b_create_organization#what-a-managed-child-organization-can-and-cannot-do).

In the **Admin Portal**, go to **B2B Identity** > **Organizations** > [your org] > **Applications** tab and select **+ Add application**.

/* Blockquote intro block */
    [data-component-name="Markdown/Markdown"] blockquote {
        border-left: 4px solid #BBC5FF !important;
        border-radius: 2px;
        background-color: #F1F2FF !important;
        padding: 20px 10px 15px 10px;
        margin: 10px 1px;
    }

    /* Configure org roles & auth — bordered example table */
    .b2b-wip-table-wrap {
        margin: 10px 0;
        border-radius: 5px;
        overflow: hidden;
        border: 1px solid #ededf2;
    }

    table.b2b-wip-bordered-table {
        border-collapse: collapse;
        width: 100%;
        margin: 0;
    }

    table.b2b-wip-bordered-table th,
    table.b2b-wip-bordered-table td {
        border: 1px solid #ededf2 !important;
        padding: 10px;
        text-align: left;
        vertical-align: top;
    }

    table.b2b-wip-bordered-table thead th {
        background-color: #f5f5f5 !important;
        color: #000000 !important;
        font-weight: 600 !important;
    }

    table.b2b-wip-bordered-table ul {
        margin: 0;
        padding-left: 1.25em;
    }