Sign up
Back to docsOrganization access

One key for the company, access per person.

An admin saves a connector key once for the organization and decides who can use it. Members never see the key. Groups, Microsoft Entra roles and a short policy keep that decision current as people join and leave.

Open organization connectionsEnterprise-managed authorization

Write-only keys

An org key is stored once and never shown again. Replace it; nobody reads it back.

Grants and groups

Give a member or a whole group full or read-only access to a key.

Policy

Decide whether members may add personal keys and which public connectors are available.

Who controls what

Three roles, no surprises.

Owner

  • Everything an admin can
  • Invite and remove admins; promote or demote members
  • Change the organization name and address
  • Link or unlink the Microsoft tenant
  • Transfer ownership to an admin

Admin

  • Add, replace, test and remove organization keys
  • Grant members and groups full or read-only access to a key
  • Create groups and manage who is in them
  • Invite and remove members; approve or deny join requests
  • Set the access policy: personal keys, what members see, public connectors

Member

  • Use the connectors the organization granted them, at the granted level
  • Add a personal key where the policy allows it
  • See their own access on the MCP Servers page

A member with both a direct grant and a group grant gets the higher level. Grants apply in the member's current organization only.

What members see

Every connector card says where it stands.

Provided by your organization

The org holds the key and you have a grant. A Read-only badge means writes are refused.

Ask your admin for access

The org holds the key but you have no grant. Admins can hide these cards instead.

Enter credentials

No org key. You may add your own key, unless the policy blocks personal keys for that connector.

Not shown

A personal key the policy blocks, or a public connector the organization turned off.

Microsoft Entra

Roles and groups follow your tenant.

Once the owner signs in with Microsoft, the tenant is linked. From then on the PatchOps.Admin and PatchOps.Member app roles decide each person's PatchOps role at every Microsoft sign-in. A person whose roles were all removed in Entra leaves the organization on their next sign-in and keeps a personal workspace. The owner is never removed.

A PatchOps group can be mapped to one Entra security group. At each Microsoft sign-in the person is added to or removed from mapped groups to match the token's groups claim. Groups without a mapping are never touched, and a token that carries no usable claim changes nothing.

People who sign up with the organization's verified email domain can ask to join. Admins approve the request, or the organization can join them at once or turn this off.

Credential boundary

Keys stay with the organization.

An organization key is encrypted at rest and used only when a granted member runs a connector. No page, API or MCP tool returns it. To rotate it, an admin replaces it; the old key is gone for everyone at once.

Personal OAuth sign-ins (Outlook, Teams, Google, GitHub) are never converted into organization credentials.