# Set members

> This page is the **detail** for [Setup overview — Step 8: Set members](/guides/user/b2b/b2b_setup-overview#step-8-set-members).
When users join an organization, they automatically inherit the [role groups assigned to that organization](/guides/user/b2b/b2b_configure_org_roles_auth#configure-role-groups-per-organization-and-application). For each member, you then assign a specific **organization-level role**, which defines their permissions within the organization (for example, admin or member-level access).


## Understand members

In our **[holiday booking](/guides/user/b2b/b2b_main-concepts)** example, continue with the same organizations from the previous steps: **Retail travel agency** and its managed child organization **New York branch**. The parent organization has the **Retail storefront** role group assigned, while New York branch has **Retail sales only**. Those organization-level assignments define the maximum application scope available in each organization.

In Mosaic, a **member** is a **user** in the context of a specific organization. The same user can be a member of multiple organizations, which is why you may also see that person in **B2B Identity** > **Users**.

When you add an individual member, you do two different things:

- You decide which **app-level member roles** that person should get for each application, but only from the roles allowed by the organization's assigned role groups.
- You assign an **organization-level role** such as admin or member, which controls what that person can do in Mosaic for that organization.


For example, **Jane Smith** in the **Retail travel agency** might receive **Booking agent** and **After-sales specialist** for the holiday booking platform, plus the **Organization admin** role so she can manage members. In **New York branch**, **John Williams** might receive only **Booking agent**, plus the **Organization member** role.

This is why member setup comes last: the member can receive only the application roles already allowed for that organization.

## Configure members

Admin Portal 
In **Admin Portal** > **B2B Identity** > **Organizations** > [your org] > **Members** tab, click **+Add member** (or edit an existing member), a **Member details** drawer opens with two tabs: **Member details** and **Applications access**. Complete **Member details** first, then **Applications access**, and save. If you use **email invites**, [Configure B2B](/guides/user/b2b/b2b_configure_b2b) should already be set so you can send the invite after saving.

### Member details

Open the **Member details** tab and fill in the member’s profile:

- **Email** *(required)*: Primary identifier for the member. Used for the invite, sign-in, and routing to the correct organization (together with the org’s **email domains**).
- **Phone number**: Contact number for the member profile.
- **Default language**: Preferred language for the experience.
- **Department**: Internal grouping (for example agency department or team).
- **Title**: Job title or label shown in the directory.
- **Direct manager**: Reference to the member’s manager.


### Applications access

Open the **Applications access** tab and give the member access to one application. To give the same member access to further applications, edit the member once they exist — see [Manage org members](/guides/user/b2b/b2b_create_organization#manage-org-members).

- **Application** *(required)*: Select one of the applications linked to the organization.
- **Roles** *(required)*: Select the roles this member should have for that application. The list holds the **member roles** the organization has for that application, through its assigned role groups, together with the three organization-level roles — **Organization admin**, **Managed Organization Creator**, and **Organization member** — which every organization always has. Select **All roles** to take them all at once. If the list is empty or narrower than expected, go back to [Configure role groups per organization and application](/guides/user/b2b/b2b_configure_org_roles_auth#configure-role-groups-per-organization-and-application). The application consumes the result, for example in **ID token** claims.
- **Send invitation to user**: Select this to send the member an invitation email when you save. [Configure B2B application settings](/guides/user/b2b/b2b_configure_b2b) must already be in place for the invite to be sent.
- **Assign temporary password**: Turn this on to have Mosaic generate a password for the member. The generated password is shown to you, and it's up to you to pass it on to them.


A member starts with no roles: nothing is assigned automatically, including the organization-level roles such as **Organization admin** and **Organization member**. Those define what the member can do **in the Organization admin portal** — portal management, invitations, managed orgs — and are not the application's member roles. For the full list, see [Roles](/guides/user/b2b/b2b_org_portal#roles).

- Set **access** to the application when the UI offers it (toggle or equivalent).
- Assign **member roles** for that application: choose **which** of the allowed app-level roles this person should have. Only roles that belong to the organization’s **assigned role groups** appear—those groups were set under [Configure org roles & auth](/guides/user/b2b/b2b_configure_org_roles_auth#configure-role-groups-per-organization-and-application). Your customer-facing application consumes the result (for example **ID token** claims); see [Configure org roles & auth](/guides/user/b2b/b2b_configure_org_roles_auth).


Assign **Roles** (**organization member roles**) for this **member**—what they can do **in the Organization admin portal** (portal management, invitations, managed orgs). These are **not** your custom application roles. For the detailed list, see [Roles](/guides/user/b2b/b2b_org_portal#roles) for the full list.

Ongoing member management
Once the initial setup is complete, you can edit members, reassign applications and roles, suspend access, or remove members at any time. See [Manage org members](/guides/user/b2b/b2b_create_organization#manage-org-members).

Automate role assignment
If the organization uses a federated identity provider for SSO, you can automate member role assignment instead of configuring roles manually. See [Automatic member role assignment](/guides/user/b2b/b2b_map_idp_groups_to_roles).

## Next steps

This is where the setup ends and the implementation begins, and the two paths don't overlap: follow the one that matches your client's **Login Experience**.

Choose your path
- **Journey-orchestrated** — [Build the B2B journeys](/guides/user/b2b/b2b_build_journeys) for Mosaic-hosted screens, or follow [Self-hosted SSO UI](/guides/user/sso_orchestration/sso_quickstart_selfhosted_ui) for **Self managed (Custom UI)**.
- **Application-controlled** — [Implement B2B login with APIs](/guides/user/b2b/b2b_login_with_apis).


If you use Mosaic's member invite flow, also [build the invite journey](/guides/user/b2b/b2b_build_journeys), whichever login model you chose.

[data-component-name="Markdown/Markdown"] blockquote {
        border-left: 4px solid #BBC5FF !important;
        border-radius: 2px;
        background-color: #F1F2FF !important;
        padding: 20px 10px 15px 10px;
        margin: 10px 1px;
    }