The console: layout and roles
For every administrator of the Organisations console, and anyone deciding what access to give a colleague.
Before you start: the console lives at the hostname chosen at install; once single sign-on is connected, password sign-in is off for everyone (see Sign in with Entra ID).
Sign in
While your session resolves the page reads "Signing you in…". A failure reads Could not sign you in with a Technical details disclosure; retrying reloads the page. If your single sign-on session runs out mid-work, the overlay Your session has expired offers Sign in again.
Find your way around
The dock at the bottom of the screen has seven entries:
| Dock entry | Opens |
|---|---|
| Home | Your fleet summary. |
| Fleet | Every deployment (Fleet). |
| Accounts | The AWS accounts you deploy into (Accounts). |
| Libraries | Shared resource stores (Libraries). |
| Identity & Access Management | Admins if you can manage administrators, otherwise Policies. |
| Documentation | This site, in a new tab. |
| Sign out | The last item, set slightly apart: signs you out of the console. |
The sidebar groups every screen: Fleet Management (Fleet, Fleet Configurations, Update Manager, Address plan), Account Management (Accounts), Identity & Access Management (Admins, Identity Providers, Roles, Policies, Users, Groups, Programmatic Access, Audit) and Library Management (Libraries). Its footer shows your email.
An entry you may not open is disabled and its hover names what it requires: Admins, owner or operator; Roles, owner or operator or an AccessAdministrator grant; Users and Groups, the IdentityProviderManager role; Programmatic Access, a Programmatic Access role; Audit, an AdminManage-class grant.
Read Home
Home shows a Total deployments tile and one tile per health state present: Provisioning, Awaiting input, Healthy, Degraded, Failed, Deleting, Disabled, Uninstalled. View all deployments → opens the Fleet. If you may view accounts and one is unverified or failed verification, Accounts needing verification lists it as "not yet verified" or "verification failed".
Reload when the console is updated
When Organisations is upgraded while you are signed in, a banner reads "The Organisations console was updated. Reloading to pick up the latest version…" with Reload now, and the console reloads itself four seconds later. A job that was running keeps running; reopen it from Jobs. Navigating away from a running deployment shows the dialog Deployment in progress: the job keeps running in the background.
Lists, search and paging
Every list in the console is read page by page from the server, so a fleet of hundreds of deployments or a directory of thousands of people loads as quickly as a small one, and a search always covers the whole collection, not only the rows on screen.
| List | Page size | Search |
|---|---|---|
| Fleet, Accounts, Libraries and their members and items, Fleet Configurations, Update Manager rules and their history, Admins, Identity Providers, Roles' grants, Programmatic Access keys, Address plan, a deployment's Jobs | 20 | A case-insensitive match on the start of the name or id, run on the server. Fleet matches the app domain, deployment ID, account alias or account ID (not the Name column); Accounts matches alias or account ID |
| Users and Groups (your Entra directory) | 50 | Microsoft Graph search on display name or email (two characters at least). The hint "Showing first 50 · refine your search to narrow the list." appears on the first page when there are more |
| A deployment's Identity list of who can sign in | 20 | "Search by name or email" searches your whole directory; when a page holds no match yet it offers Keep searching |
| Audit | 50 (up to 200) | Exact actor and action filters over a window of up to 90 days |
Under each list Previous and Next move between pages and the footer says whether more rows follow or the list has ended. Pickers (a deployment, an account, a person) search the server as you type and say when more matches exist than they show. Totals, such as Home's Total deployments and its tiles, count the whole fleet. Adding ?pageSize=<n> to a list's address changes its page size within the list's own bounds; ?pageSize=default restores it. A list opened straight from such an address can show its default size instead; reload the page and the size applies.
Understand the role model
Access is granted two ways, both from Users, groups and roles:
- Three organisation-wide tiers. Owner and Operator: every administrative action in this guide, including granting or revoking Roles and tiers; the one difference the console enforces is that the last remaining Owner cannot be revoked. Viewer: read-only access across the organisation.
- Built-in Roles, granted organisation-wide or on one resource: LibraryViewer, LibraryContributor, LibraryManager, FleetViewer, FleetOperator, DeploymentOperator, AccountManager, AccountViewer, IdentityProviderManager, IdentityProviderViewer, AccessAdministrator, StudioUser, ProgrammaticAccessAdministrator and ProgrammaticAccessViewer. StudioUser is the one Role that is not about the console: it lets a person sign in to a Studio deployment.
Viewers can read the Fleet, deployment detail, Accounts, Identity Providers, Libraries, deployment drafts and API keys. Everything else needs the Owner or Operator tier or the matching Role: creating, pausing, resuming, upgrading, reconfiguring, rolling back or uninstalling a deployment and retrying, resuming or abandoning its jobs; registering, verifying, clearing or deleting an AWS account; connecting or deleting an identity provider, linking it to a deployment, assigning people and browsing the directory; creating Libraries, managing members and pushing items; Fleet Configurations and Update Manager rules; per-user token attribution; Admins, Roles, grants and the shared Entra credentials; API keys; Audit.
The server checks every action on each request. A disabled button carries the reason as hover text; a refused request, or a list you may not read, shows "You don't have permission to <do this>. An owner or operator can grant you access in Identity & Access Management."
What you should see
A person who can sign in but holds no role sees Home as You have access to nothing yet: "Ask an administrator to grant you a role in Identity & Access Management." Only entries that need no permission, such as Policies, open for them.
Notes
- Signing in with no role is not refused; you get the zero-access Home until an Owner or Operator grants you a Role or a tier.
- Old bookmarks to a Settings screen open the Fleet. The shared Entra application credentials moved to Identity Providers as Platform setup; release choice is the deployment wizard's Release version step.
- Policies is readable by anyone who can sign in; what a Role does cannot be changed from the console.
- Repeated sign-in failures: your identity administrator has not assigned you to the console's Enterprise Application in Microsoft Entra.
- The console refuses to revoke the last remaining Owner; grant another Owner first.