Organization access, verification and session renewal¶
Signing in identifies your account. Selecting an organization establishes the workspace in which you intend to work. Membership, organization policy, subscription coverage and your product licences then determine the access available there.
Use the existing membership guide for inspected screen journeys. This page explains access outcomes and recovery; it does not introduce steps from an unfinished frontend.
What must be true before you enter¶
Your account and sign-in must remain valid. You must be a member of the selected organization with active membership and branch access. The organization's email-access policy must permit your account. Organizations that are still being provisioned or are no longer selectable cannot be entered through ordinary organization selection.
An organization can require additional verification even after you have signed in. When qualifying verification is absent, selection returns an email-code challenge instead of opening product access. The challenge itself does not grant an organization session, product permissions or confirmation that billing is clear.
The code is tied to your account and the selected organization. Requesting another challenge replaces the previous code for that purpose. Completing verification checks your account, membership and organization policy again. An expired or invalid code cannot complete selection.
Understand the result of selection¶
| Result | What it means |
|---|---|
| Additional verification required | Complete the requested verification before selection can finish. No new organization access has been returned yet. |
| Normal organization access | The response identifies the workspace, your administration/head status and product licence information, and includes permission information for the new session. Each action still has its own authorization rules. |
| Administrator recovery access | An eligible organization administrator can receive limited access to address blocked billing or suspension. Product grants are omitted. Ordinary members must ask an administrator to restore access. |
A product listed in the selection result can represent its latest licence record, including a revoked licence. Its active status matters; appearing in a list does not by itself establish usable product access. See product access and permissions.
Recovery access does not revoke every retained licence, pay an invoice or reinstate the organization. Billing-related suspension asks for renewal. An administratively paused organization may allow its administrator to restore it; other suspensions require support. A billing action does not override an unrelated suspension.
Coverage is checked again while normal selection completes. If it expires during that work, selection can fail and require another selection for recovery. The duration of a sign-in credential is not a promise that subscription access lasts just as long.
Why a session renewal can behave differently¶
Session refresh renews credentials through the identity service, then checks the account and issues matching permission information when the returned session belongs to an organization. A platform-level session without an organization has no product permission set attached.
Refresh can reuse cached product-role information. Selecting an organization requests fresh provider information, but temporary permission-provider failure can still omit some actions. Neither operation extends paid coverage or grants a missing licence. The permission explanation describes those differences.
Refresh is not the complete organization-selection process and does not itself return a fresh product list or a new organization-selection result. Additional verification may be requested again when the organization policy cannot establish the required assurance. Support impersonation sessions cannot be renewed like ordinary user sessions.
When selection is interrupted¶
Verification, identity synchronization and permission issuance involve separate systems. If selection completes but its response is lost, the verification code may already have been consumed. If an earlier failure interrupts selection, some database work can be rolled back while identity-service or verification-cache updates may remain. Repeating a code is therefore not a guaranteed recovery action.
Follow the displayed recovery outcome. A session-mismatch message calls for a fresh sign-in or organization selection; a membership or policy denial needs the relevant administrator; a billing or suspension outcome needs the corresponding recovery process. Reassigning a product licence is not a general repair for all these conditions.
When asking for help, record the selected organization, whether the issue occurred during selection, verification or refresh, the approximate time and the displayed message. Never include passwords, verification codes, access tokens or refresh tokens in ordinary support messages.