Skip to main content
Organization member invitations are available on .
Members are people who can sign in to an organization. Membership determines which organizations a user can see, which settings they can manage, and which servers they can access through organization and server roles.

​
Membership contract

Membership gives a person access to an organization. It does not automatically grant access to every restricted server unless the person is an organization admin or the server has a default role.
PropertyContract
Organization boundaryA user must be a member of the organization to access its Horizon resources.
Organization roleAdmin or Member defines the user’s organization-level baseline.
Server accessNon-admin members need explicit server grants or server default roles.
API keysUser-owned API keys use the user’s current access. Removing the user removes the useful scope of those keys.
RemovalRemoving a member removes their membership and explicit access grants in that organization.
Use service accounts for durable automation. User-owned keys should stop being relied on when that user leaves the organization.

​
Member lifecycle

1

Invite a person

Organization admins can invite a person by email.
2

The invitation is accepted

The person joins the organization after accepting the invitation and completing sign-in.
3

Assign access

Give the member an organization role and, when needed, explicit server access.
4

Review usage

Use users, sessions, and request logs to understand how the member’s clients interact with deployed servers.
5

Remove access

Removing a member removes their organization membership and their explicit server access grants in that organization.

​
Invitation states

StateMeaning
PendingThe invitation has been sent but not accepted.
AcceptedThe invited person joined the organization.
ExpiredThe invitation can no longer be accepted. Send a new invitation if needed.
RevokedAn admin canceled the invitation before it was accepted.

​
Roles

RoleContract
AdminCan manage organization settings and has full server access.
MemberCan access servers through explicit grants or server default roles.
Server-level roles can further grant admin, editor, or viewer access to a specific server. See Authorization for the full resolution model.

​
Access changes

ChangeEffect
Promote member to adminThe user gains organization management access and full server access.
Demote admin to memberThe user loses admin bypass and must rely on explicit server grants or defaults.
Remove explicit server grantThe user may still retain access through a server default role or organization admin role.
Remove member from organizationThe user can no longer access organization resources.
Reinvite removed userNew membership does not automatically recreate all prior explicit server grants.

​
Reviewing members

Review membership from two directions:
  • Organization view: who can sign in, who is admin, and who counts toward seats.
  • Server view: who can access a specific server and with what role.
For sensitive servers, review explicit grants and the server default role together. A restrictive explicit grant is not useful if the server also gives the whole organization a broad default role.

​
Operational guidance

  • Give admin access only to people who should manage billing, organization settings, integrations, and access.
  • Use explicit server grants for people who need access to restricted servers.
  • Remove members promptly when they leave the organization.
  • Use service accounts for automation instead of adding shared human accounts.

Roles

Review the role model used by Horizon.

Authorization

See the full access resolution model for users and servers.