Skip to content

Accounts & Organizations

Every user in NetDefense has a personal account (email + password) that is separate from organization membership. A single account can belong to multiple organizations, each with a different role. An organization is the top-level container in NetDefense — all devices, policies, accounts, and configurations live inside an organization.

Authentication & Identity

Section titled “Authentication & Identity”

Your account holds your personal identity (email, name, status) and the organizations you belong to.

Open Settings from your avatar menu at the bottom of the sidebar: Account Information shows your email, status and how many organizations you’re in. Manage Organizations, in the organization switcher at the top of the sidebar, lists them with each one’s plan and status. See Organization management.

Organization Management

Section titled “Organization Management”

An organization groups everything together — think of it as a tenant or workspace. Each organization has a Registration Token that devices running NDAgent present the first time they connect, so NetDefense knows which org they belong to.

A leaked registration token isn’t a crisis: every new registration lands in PENDING until an administrator explicitly approves it, and once approved each device authenticates with its own signing key rather than the token. The worst-case exposure is unwanted PENDING registrations that an admin can reject.

Choose Manage Organizations in the organization switcher to list your organizations. Clicking a row switches to that organization, and its detail page is where an admin manages its members and invitations.

Organization Roles

Section titled “Organization Roles”

Each account member is assigned one role that controls what they can do inside the organization:

RoleShortPermissions
SuperuserSUEverything Read-Write can do, plus: manage members and their roles, send and revoke invitations, change the organization’s settings or delete it, manage billing, and save snippets that grant firewall administrator rights and the variables they use.
Read-WriteRWEverything Read-Only can do, plus every other change: approve devices, run tasks and syncs, and manage snippets, templates, OUs, variables, VPN networks, backups and firmware tracks. Opens full remote sessions. Cannot manage members, roles or invitations, change or delete the organization, manage billing, or save snippets that grant firewall administrator rights.
Read-OnlyROViews and lists everything, and opens and follows support tickets. Remote sessions are read-only (early access). Cannot change the organization’s resources. Useful for auditors or monitoring dashboards.

A personal access token never acts above Read-Write, whatever its owner’s role.

Accounts

Section titled “Accounts”

Organization accounts show all members and their current status. Invited members who have not yet accepted will show - for their name.

Open the organization from Manage Organizations, then Members: it lists every account with its role, status and join date, and an admin can change a role, disable a member or invite someone. See Members.

Invitations

Section titled “Invitations”

To add someone to your organization, you send them an invitation specifying their role. The invitee receives a notification and can accept or decline. Once accepted, they appear as a regular account member with the assigned role.

An invitation goes through these states:

StateMeaning
INVITEDWaiting for the recipient to respond.
ENABLEDAccepted and active.
DECLINEDThe recipient declined the invitation.

An admin invites people from the organization’s Members page. Pending invitations you’ve sent are under Sent on the Invitations page in your avatar menu, with Revoke; invitations to you are under Received, with Accept and Decline. See Invitations.