> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kostra.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Getting Started: Access, Organizations & Roles

> How a new team accesses the KOSTRA portal, how organizations work, and what each user role can do.

# Getting Started: Access, Organizations & Roles

Before you connect a cloud account or explore costs, your team needs access to KOSTRA and a clear picture of who can do what. This guide covers how new users get into the portal, how organizations structure your workspace, and what each user role allows.

## Accessing the portal

KOSTRA runs in a browser at your instance's address — the URL KOSTRA provides for the managed service, or your own hostname if you self-host. There are two ways a person gets access:

* **Create an account.** A new user registers with an email and password from the sign-in page. Registering establishes a new **organization** for that user, who becomes its first manager. This is how a brand-new customer starts.
* **Accept an invitation.** An existing organization manager invites a colleague by email. The invitee receives a link, accepts the invitation, and sets a password — joining that organization with the role they were given.

If single sign-on is configured for your instance, users can sign in through your identity provider instead of a KOSTRA password.

## Organizations

An **organization** is your tenant in KOSTRA — your company's workspace. It contains everything: your connected cloud accounts, your pool structure, your users, and all the cost, recommendation, and modernization data derived from them.

A single person can belong to more than one organization — for example, a consultant working across several clients — and switch between them from the organization selector. Data never crosses organizations; each is fully isolated.

## Users and roles

KOSTRA grants access through three roles, each **scoped** to either the whole organization or a specific pool (and everything beneath it). Scoping is what lets you give a team lead full control of their own pool without exposing the rest of the estate.

| Role                     | Scope              | What they can do                                                                                                                    |
| ------------------------ | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------- |
| **Organization Manager** | Whole organization | Full control: connect and manage data sources, manage every pool, invite and manage users, and configure all settings.              |
| **Manager**              | A specific pool    | Full control within that pool and its sub-pools: manage resources, assignment rules, budgets and constraints, and the pool's users. |
| **Engineer**             | A specific pool    | Operational access within the pool: act on resources and recommendations, but not manage users or the pool's structure.             |
| **Member**               | Their scope        | Visibility of the resources and costs within their scope.                                                                           |

The Organization Manager is simply the Manager role applied at the top of the organization. Because roles are scoped to pools, the same person can hold different roles in different parts of the tree.

## Inviting your team

Managers add colleagues from the **Users** area:

1. Open **Users** and choose to invite a colleague.
2. Enter their **email address**.
3. Select a **role** — Organization Manager, or a pool-scoped Manager or Engineer.
4. If the role is pool-scoped, choose the **pool** it applies to.
5. Send the invitation.

The invitee receives an email, accepts, and joins the organization with exactly the access you assigned. You can adjust or revoke a user's access later from the same area.

## A recommended first-run setup

Once you have access, a practical order for standing up KOSTRA:

1. **Connect a data source** — see [Connect a Huawei Cloud Data Source](/guides/connect-huawei-cloud) or [Connect AWS, Azure, or Google Cloud](/guides/connect-aws-azure-google).
2. **Model your teams with pools** — see [Organize Spend with Pools](/guides/organize-with-pools).
3. **Invite your team** with roles scoped to the right pools.
4. **Establish a baseline** in [Explore Your Costs](/guides/explore-costs), then start on [Recommendations](/guides/act-on-recommendations).

## Related pages

* [Connect a Huawei Cloud Data Source](/guides/connect-huawei-cloud)
* [Organize Spend with Pools](/guides/organize-with-pools)
* [Security & Data Protection](/security-and-data-protection)
* [Product Overview](/product-overview)