Roles, Teams, Companies, Organization Owners, SSO, and Service Accounts in Docker

### What are roles? A role is a collection of permissions granted to members. Roles define access to perform actions in Docker Hub like creating repositories, managing tags, or viewing teams. See [Roles and permissions](roles-and-permissions.md). ### What’s a team? A team is a group of Docker users that belong to an organization. An organization can have multiple teams. An organization owner can then create new teams and add members to an existing team using Docker IDs or email address and by selecting a team the user should be part of. See [Create and manage a team](manage-a-team.md). ### What's a company? A company is a management layer that centralizes administration of multiple organizations. Administrators can add organizations with a Docker Business subscription to a company and configure settings for all organizations under the company. See [Set up your company](/admin/company/). ### Who is an organization owner? An organization owner is an administrator who has permissions to manage repositories, add members, and manage member roles. They have full access to private repositories, all teams, billing information, and organization settings. An organization owner can also specify [repository permissions](manage-a-team.md#configure-repository-permissions-for-a-team) for each team in the organization. Only an organization owner can enable SSO for the organization. When SSO is enabled for your organization, the organization owner can also manage users. Docker can auto-provision Docker IDs for new end-users or users who'd like to have a separate Docker ID for company use through SSO enforcement. The organization owner can also add additional owners to help them manage users, teams, and repositories in the organization. ### Can I configure multiple SSO identity providers (IdPs) to authenticate users to a single org? Yes. Docker SSO supports multiple IdP configurations. For more information, see [Configure SSO](../../security/for-admins/single-sign-on/configure/_index.md) and [SSO FAQs](../../security/faqs/single-sign-on/faqs.md). ### What is a service account? > [!IMPORTANT] > > As of December 10, 2024, service accounts are no longer available. Existing Service Account agreements will be honored until their current term expires, but new purchases or renewals of service accounts no longer available and customers must renew under a new subscription. It is recommended to transition to Organization Access Tokens (OATs), which can provide similar functionality. For more information, see [Organization access tokens (Beta)](/manuals/security/for-admins/access-tokens.md).

This section defines roles, teams, and companies within Docker. It details the responsibilities and permissions of an organization owner, including managing repositories, members, SSO, and billing. It also clarifies the possibility of configuring multiple SSO identity providers for a single organization. Finally, it contains a notice that Service Accounts are being deprecated and suggests migrating to Organization Access Tokens.