Create and switch organizations
An organization holds your devices, members and access rules. Create one, belong to several, and move between them in the dashboard, the apps and the CLI.
An organization is the space everything else lives in. Its devices, members, groups, access rules, networks, DNS servers, enrollment keys and settings belong to it alone, and nothing you set up in one organization has any effect in another.
A person can be a member of several organizations, with a different role in each. Their sign-in is the same everywhere: one password, one set of second factors and passkeys. A device, on the other hand, is connected to one organization at a time.
Create an organization
- 1
Sign in without an organization
Choose Register on the sign-in page at
app.sxaccess.com, or use Continue with Google, and sign in. As long as your account belongs to no organization, the dashboard opens Create your Organization instead of its usual pages. - 2
Choose a name
Use 3 to 32 characters: lowercase letters, digits and hyphens, starting and ending with a letter or digit, such as
acme-corp. Capital letters are turned into lowercase. The name must not be taken already, and the dashboard shows it read-only afterwards, so pick one you are happy to keep. - 3
Create it
Under Choose a plan, leave the plan that is already selected, and choose Create organization. You become its owner, and the dashboard opens inside it. Invite your team from People → Members, as described in Add members, and add your first device with Add device.
Join another organization
To bring you in, an owner or admin of that organization invites your email address from People → Members → Invite member. If the address already has an SXAccess account, you are added straight away, with the role and groups they chose. An email with the subject You were added to <organization name> on SXAccess tells you so. Nothing else is needed: sign in the way you already do and switch to the organization. If the address has no account yet, the invitation email takes you through creating one first.
Your role and your groups are set per organization, so you can be the owner of one and a regular member of another. Being removed from one organization with Remove from this organization takes away your devices and your access there, and leaves your account and your other organizations untouched.
Switch in the dashboard
The organization you are working in is named at the top of the navigation rail; on a narrow screen it moves to a bar above the page, with a Switch button. Open it to see Your organizations and choose one. The dashboard reloads inside the organization you chose, starting at Overview, and this browser remembers your choice. Until you have chosen, the dashboard opens the organization where you hold the most senior role.
A shield next to an organization in that list means it asks for a second factor, so switching to it may ask you to Confirm it is you; see Two-factor and passkeys. A red suspended badge marks a suspended organization, described below. If your role may see settings, the same menu leads to Organization settings, covered in Organization settings.
Switch in the apps
The apps connect to one organization at a time, and you switch only while connected. Choosing an organization never switches straight away: a confirmation first says what will happen. Switching to an organization this device has already joined keeps its device identity and needs no browser. Joining one for the first time enrols the device there with a new device identity, and opens the browser if your sign-in has to be renewed. Either way, the device disconnects from the organization it leaves.
| App | Where to switch |
|---|---|
| macOS and Windows | The organization pill at the bottom of the sidebar opens Switch organization, with each organization marked CURRENT, ENROLLED or NOT JOINED. A Mac enrolled with an enrollment key has no pill. See macOS and Windows |
| iPhone and Android | The organization pill at the top of the Shield screen, shown once you belong to more than one organization. See iOS and Android |
Switch with the CLI
On a machine that runs the CLI agent, sxaccess tenant lists, shows and switches organizations. sxaccess tenant switch with no name signs you in if it has to, lists every organization your account belongs to and joins the one you pick. Given the name of an organization this device has already joined, it switches straight there, without a browser. sxaccess tenant current prints the active one, or No active organization.
When you sign in with sxaccess start and belong to several organizations, the CLI asks which one to enrol the machine into; --tenant with an organization ID answers that in advance. An enrollment key always enrols into the organization it was created in. The full walk-through is on Switch organization.
$ sxaccess tenant listYour organizations (* = active, ✓ = joined on this device): * ✓ acme-corp (d3h0k2ss5ltc73a9h6v0) ✓ acme-labs (d3h1a8ss5ltc73a9h6vg)Switch with: sxaccess tenant switch <name>$ sxaccess tenant switch acme-labsSwitched to organization acme-labsOne organization per enrolment
Each organization a device joins is a separate enrolment. The device appears in each of those organizations as a device of its own, with an overlay address, groups and access rules from that organization; the apps show the address as Tunnel address. Removing it from one organization leaves its enrolment in the others alone. A device enrolled with an enrollment key belongs to the key's organization. In the apps it has no organization list to switch from; with the CLI, sxaccess tenant switch signs in with a member's account and enrols the machine into another organization as a separate device.
In the API
Every API call acts within one organization. An access token always acts in the organization it was created in. A request that carries a member's sign-in, as the dashboard's requests do, acts in the organization that the X-Organization-Id header names; naming one the member does not belong to is refused. Without the header, it acts in the member's default organization: the one where they hold the most senior role, which is also the one the dashboard opens before they choose. See the Public API.
When an organization is suspended
A suspended organization is closed to every member at once. In the dashboard its pages are refused, the organization menu shows a red suspended badge, and the owner sees the notice This organization is suspended. Its devices cannot connect: the apps report Organization suspended, and sxaccess info on a machine with the CLI says that the device's organization is suspended.
Nobody needs to sign in again or reinstall anything. Devices keep trying about every five minutes and reconnect on their own once the suspension is lifted. If you are the owner, write to support@sxaccess.com; anyone else should contact the owner or an admin of the organization.