# Organization admin portal

The Organization admin portal is a self-service portal where org admins manage their own organization — its profile, members, authentication methods, and managed child organizations — without access to the main Admin Portal.

## Access the portal

An org admin is a member who holds the **Organization admin** role. They're added and invited by email like any other member, either from the Admin Portal or by an org admin already in place — see [Set members](/guides/user/b2b/b2b_set_members).

Each application has its own portal URL, in the form `<subdomain>.org.transmitsecurity.io`, where the subdomain is the application's. Copy it from [Configure the Org admin portal](/guides/user/b2b/b2b_configure_b2b#2-configure-the-org-admin-portal) to pass it on to the organization's admins.

An org admin sees only the applications and organizations they have access privileges for. Everything except the organization's profile is scoped to the application they've selected: the members, roles, and authentication settings they see belong to that organization **within that application**, and an organization used by two applications is configured separately in each.

## Organization profile

Go to **Organization Profile** to view the organization's details, and select **Edit** to change them. Changes apply across the entire organization and all its applications.

| Field | Description |
|  --- | --- |
| **Org ID** | The organization's identifier in Mosaic. Read-only. |
| **Name** | The organization's display name. |
| **Alias** | An alternative name for the organization. |
| **Domains** | The member email domains registered for this organization. |
| **Organization logo** | The image shown for this organization. |


## Members

Go to **Members** to manage the organization's members for the selected application. Filter the list by **Status**, by **Roles**, or by **Inactive over** a given number of days, search it by email, and select **Export CSV** to download it.

Add member fields
Select **+ Add member**.

| Field | Description |
|  --- | --- |
| **Email** | The member's email address. It's their primary identifier, used for the invite, for sign-in, and for routing to the correct organization. |
| **Phone number** | Contact number for the member profile. |
| **Default language** | The member's preferred language. |
| **Roles** *(required)* | The roles the member holds in the selected application. The list holds the **member roles** the organization has for that application, through its assigned role groups, together with the three organization-level roles — **Organization admin**, **Managed Organization Creator**, and **Organization member** — which every organization always has. |
| **Send invitation to user** | Sends the member an invitation email on save. Requires the [invite flow](/guides/user/b2b/b2b_configure_b2b#1-configure-the-invite-flow) to be configured. |
| **Assign temporary password** | Assigns the member a temporary password. |


Member actions
Open the **⋮** menu next to a member.

| Action | Description |
|  --- | --- |
| **Member details** | View and edit the member's profile fields. |
| **Assign roles** | Update the member's roles for this application. |
| **Suspend** | Suspend the member. A suspended member can't sign in until their access is restored. |
| **Terminate sessions** | End all of the member's active sessions. |
| **Reset password** | Send the member a password reset email. |
| **Resend invitation** | Resend the invitation email, if the original expired or wasn't received. |
| **Manage passkey credentials** | View and remove the passkeys the member registered. |
| **Remove member from app** | Remove the member's access to the application within this organization. |


Members are managed from both sides, on the same set of members: org admins here, platform admins from **Admin Portal** > **B2B Identity** > **Organizations** > [your org] > **Members**. Neither side has to wait for the other. See [Set members](/guides/user/b2b/b2b_set_members) for the initial setup, and [Manage org members](/guides/user/b2b/b2b_create_organization#manage-org-members) for ongoing management.

## Roles

Go to **Roles** for the three organization-level roles. They govern what a member can do in the organization itself, and they're what an org admin assigns to members.

| Role | Description |
|  --- | --- |
| **Organization admin** | Enables managing members and performing administrative tasks. |
| **Managed Organization Creator** | Enables creating managed organizations in the portal. |
| **Organization member** | Basic member role. |


Your application's member roles aren't managed here. You define them for the application and make them available to each organization: see [Define the app roles](/guides/user/b2b/b2b_define_app_roles) and [Create app role groups](/guides/user/b2b/b2b_create_role_groups). An org admin can't create a role or a role group, change the permissions behind a role, or change which roles a role group contains.

The Groups tab
The **Groups** tab is unrelated to your application's role groups and doesn't list them.

## Authentication methods

An organization chooses between two ways for its members to sign in, and that choice is the only authentication decision it makes. The Mosaic sign-in experience itself is configured at application level.

Go to **Authentication Methods**.

| Option | Description |
|  --- | --- |
| **Mosaic authentication methods** | Members sign in with methods Mosaic manages. The organization inherits the application's configuration as it stands: it can't turn individual methods on or off. |
| **Federated access** | Members sign in through the organization's own identity provider. This replaces the application's sign-in options for this organization's members entirely, rather than adding to them. |


Which one an organization uses comes down to whether that business customer already runs an identity provider it wants its people to keep using. For the federated access configuration, and for what each choice means on your side, see [Configure org authentication](/guides/user/b2b/b2b_org_authentication).

## Managed organizations

Go to **Managed Organizations** to provision and manage child organizations under the current organization. In the [holiday booking](/guides/user/b2b/b2b_main-concepts) example, the **Retail travel agency** org admin uses this section to provision regional branches such as **New York branch** and give them access to the platform.

Add organization fields
Select **+ Add organization**.

| Field | Description |
|  --- | --- |
| **Organization name** *(required)* | The child organization's display name. |
| **Alias** | An alternative name for the child organization. |
| **Logo** | Select **Upload** to add an image. |
| **Domains** *(required)* | One or more member email domains for the child organization, for example `branch.com`. |
| **Assign role groups** *(required)* | The role groups the child organization can use. |


The parent decides the scope
**Assign role groups** offers only the role groups the parent exposes to its children, set in [Configure parent–child role group relationships](/guides/user/b2b/b2b_create_role_groups#configure-parentchild-role-group-relationships). If no group has been exposed, the field stays empty and no child organization can be created until one is.

Platform admins create and manage child organizations from **Admin Portal** > **B2B Identity** > **Organizations**. See [Configure parent–child organizations](/guides/user/b2b/b2b_create_organization#configure-parentchild-organizations).

[data-component-name="Markdown/Markdown"] blockquote {
        border-left: 4px solid #BBC5FF !important;
        border-radius: 2px;
        background-color: #F1F2FF !important;
        padding: 20px 10px 15px 10px;
        margin: 10px 1px;
    }