Skip to main content

Availability varies by Auth0 plan

Your Auth0 plan or custom agreement affects whether this feature is available. To learn more, read Pricing.
Organization Roles allow you to define roles that exist only within a specific Organization. Unlike tenant roles, which apply across your entire tenant, Organization roles are scoped to a single Organization. This allows users to hold different roles in each Organization.

​
Role model

Auth0 uses a two-tier role model when Organizations are enabled:
  • Tenant roles exist at the tenant level and can assign those roles to any user across all Organizations.
  • Organization roles exist within a specific Organization and apply only to members of the specific Organization.
When a user logs in through an Organization, their access token includes permissions from the roles you assign them within that Organization. These may be tenant roles, Organization roles, or both. If no Organization context is present in the authentication request, only tenant roles apply and token behavior remains unchanged.

​
Permissions

Organization roles use the same permission model as tenant roles. Permissions come from your API resource servers and are assigned to a role. A user inherits the permissions of every Organization role they hold within that Organization at login. To learn how to add permissions to a role, read Add Permissions to Roles.

​
Access control

Only tenant admins can create, edit, and delete Organization roles. Organization editors can assign and remove Organization roles for members within their Organization but cannot create or modify the roles themselves.

​
Limits

​
Learn more