Skip to main content

B2B and Organization Management

Nevis ID delivers IAM for organizations as a native part of the platform: business partners are modeled as recursive units in a hierarchy with no fixed depth limit, and enterprise roles bundle application roles per tenant, so an entire organization's entitlements are granted and withdrawn in one place. Each partner organization administers itself: a delegated administrator is scoped to their organization's unit subtree and nothing beyond it, on every interface including SCIM 2.0 (see Multi-tenancy and Delegated Administration). Organization users can be provisioned just in time on first login, over SCIM 2.0 and REST, with social and OIDC federation creating the account directly in the organization's unit, or in bulk over the SCIM API, and partner organizations bring their own corporate IdP over OIDC or SAML. Nevis ID is the IdP layer of a partner-IAM (PIAM) stack: organization structures, roles, and provisioning are native.

Also known as​

B2B capabilities, IAM services for organizations, partner IAM/PIAM, organizational hierarchy, B2B CIAM, B2B2C/B2B2E, JIT provisioning, access certification.

At a glance​

CapabilityDetails
Organizational hierarchyBusiness partner organizations are recursive units in trees with no fixed depth limit; a unit moves with its entire subtree, and organization attributes propagate into sessions and tokens for downstream authorization
Enterprise rolesTenant-specific bundles of application roles for organization-wide entitlements: adding a role to an enterprise role automatically grants it to every profile holding that enterprise role; fully administrable over the REST APIs
Delegated partner administrationA partner organization's administrator is scoped to their own unit subtree on every interface including SCIM 2.0; see Multi-tenancy and Delegated Administration
JIT provisioningAccounts are created just in time in the organization's unit: over SCIM 2.0 with unit and enterprise-role assignment in one call, on first social or OIDC login, and over REST with the target organization computed at runtime; see also Integration, APIs, and Provisioning
Organization onboardingCreate the organization's unit, provision its first administrator, and bulk-load its users over the SCIM bulk API; admin-initiated invitation onboarding with expiring URL tickets is covered under Registration, Onboarding, and Identity Verification
Corporate IdP connections (BYOI)Partner organizations bring their own IdP over OIDC or SAML; a corporate IdP connection can be pinned to a single Azure AD tenant, and multi-IdP routing selects the right IdP per request; see Federation and SSO
Per-organization application mappingA relying party resolves directly to its organization's unit at login, selecting the user's matching profile
Federation restrictionsTrusted IdPs are explicitly registered per connection with certificate-based trust, and federated credentials can be allowed or denied per organization through unit policies
B2B2C and B2B2EThe same unit trees model consumer brands, partner companies, and their departments side by side in one instance, with tenants separating populations where full isolation is needed
Access certificationNot a native capability, by scope: Nevis ID is a pure IdP; certification campaigns, access reviews, and segregation-of-duties checks live in a dedicated IGA platform reading entitlements over the REST APIs
Audit of organization changesEvery administrative change, including unit and role changes, is recorded with actor and timestamp; see Reporting, Analytics, and Audit

Concepts​

How-to Guides​

References​