Enterprise security

An enterprise is a hierarchy of IBM Cloud accounts that contains a parent level enterprise account at the top with child account groups as the middle level and optional individual accounts as the bottom level. The primary purpose for an enterprise account hierarchy is to provide centralized account management and billing.

Enterprises isolate user and access management between the enterprise account and its child accounts to provide greater security for your data. The users and their assigned access in the enterprise account are entirely separate from users in the child accounts, and no access is inherited between the two types of accounts. User and access management in each enterprise and each account is entirely separate and must be managed by the account owner or a user given the Administrator role in the specific account.

Resources and services within an enterprise function the same as in stand-alone accounts. Each account in an enterprise can contain resource groups that manage access to multiple resources. For account security and how to use resource groups, see IBM Cloud account security.

Use cases

The user lists for each account are only visible to the users who are invited to that account. Just because a user is invited and given access to manage the entire enterprise, it doesn’t mean that they can view the users who are invited to each child account.

Similar to how user management is entirely separate in each account and the enterprise itself, so is access management. This separation means that users who manage your enterprise can’t access account resources within the child accounts unless you specifically enable them to. For example, your financial officer can have the Administrator role on the Billing account management service within the enterprise account. Unless they are invited to a child account and are assigned access to the Billing account management service for that account, they can’t view offers or update spending limits for the child account.

Learn more

For an overview of enterprise accounts, see IBM Cloud docs: What is an enterprise?

For step-by-step instructions for setting up an enterprise hierarchy of accounts, see IBM Cloud docs: Setting up an enterprise

For tips for setting up an enterprise, see IBM Cloud docs: Best practices for setting up an enterprise