An organization is the top level of the Console IAM system and typically represents your company. Your organization consists of folders, projects, members, roles, and resources. Agents are associated with specific projects in the organization.

A folder enables you to group related projects together and separate them from other projects in your organization. For example, a folder might represent a geographical location (EU or US East), a site (London or Toronto), or a business unit (engineering or marketing).

You can organize folders to contain projects, other folders, or both. They are optional.

A project represents a workspace in the Console that organization members access from the Systems page in order to manage resources. For example, a project can include a Cloud Volumes ONTAP system, an on-premises ONTAP cluster, or an FSx for ONTAP file system.

An organization can have one or many projects. A project can reside directly underneath the organization or within a folder.

A resource is a system that you created or discovered in the Console.

When you create or discover a resource, the resource is associated with the currently selected project. That might be the only project that you want to associate this resource with. But you can choose to associate the resource with additional projects in your organization.

For example, you might associate a Cloud Volumes ONTAP system with one additional project or with all projects in your organization. How you associate a resource depends on your organization's needs.

Members of your organization are user accounts or service accounts. A service account is typically used by an application to complete specified tasks without human intervention.

Each organization includes at least one user with the Organization admin role (the Console automatically assigns this role to the user who creates the organization). You can add other members to the organization and assign different permissions across different levels of the resource hierarchy.

You don't grant permissions directly to organization members. Instead, you grant each member a role. A role contains a set of permissions that enables a member to perform specific actions at a specific level of the resource hierarchy.

Granting roles at a hierarchy level restricts access to the resources and services a member needs.

When an Organization admin creates a Console agent, the Console automatically associates that agent with the organization and the currently selected project. The Organization admin automatically has access to that agent from anywhere in the organization. But if you have other members in your organization with different roles, those members can only access that agent from the project in which it was created, unless you associate that agent with other projects.

You make a Console agent available for another project in these cases:

You can create an association from the Agents page within the Console IAM:

The following diagram shows a simple example of an organization that uses the default project and no folders. A single member manages the entire organization.

The following diagram shows an organization that uses folders to organize the projects for each geographic location in the business. Each project has its own set of associated resources. The members include an organization admin and an admin for each folder in the organization.