Enterprise onboarding
When you onboard an organization, set up identity, provisioning, and least-privilege access in this order:- Sign-in and SSO: Configure SAML SSO so your team signs in through your identity provider. Use Login Methods to enable or disable each authentication method organization-wide, including turning off password-based sign-in to enforce SSO as the only sign-in path.
- Multi-factor authentication: Each user can enable TOTP-based 2FA on their account settings page. For org-wide enforcement, configure your identity provider to require MFA on every SSO sign-in. See Can I enforce 2FA for all users?.
- User and group provisioning: Sync users and groups from your identity provider with Automated User Provisioning (AUP), which uses SCIM. Group memberships flow into IAM and can drive access policies.
- Least-privilege access: Assign IAM roles through access policies. Use Default Access Policies to keep common access patterns current as CoreWeave ships new roles, and create custom policies for narrower access.
Per-cluster access scoping
Managed Authentication allows all valid CoreWeave users in your organization to authenticate to any cluster in that organization. IAM roles scope what each user can do across all clusters. For more granular per-cluster control, configure a cluster to use Unmanaged Authentication with your own identity provider, or contact support about using multiple organizations for stronger separation. See How do I scope users to specific clusters?.Object Storage access without admin
Getting Object Storage credentials requires either the Object Storage Admin role or an organization access policy that grants the narrowercwobject:CreateAccessKey permission. To let users obtain credentials without the full admin role, grant them the cwobject:CreateAccessKey policy instead, then have them exchange their API access token directly for temporary credentials. Combine this with group-based bucket policies so SCIM group memberships control which buckets each user can reach.
Next steps
- Learn about IAM Access Policies.
- Create an IAM Access Policy.