1) The document discusses Anypoint Access Management which allows administrators to manage users, roles, and organizations on the Anypoint Platform. 2) Administrators can create business groups to delegate management of resources and delimit scopes of roles and permissions. Child business groups can be created within parent business groups. 3) Roles control access to resources and users must be granted roles within a business group to obtain membership and access its resources.

1. ANYPOINT ACCESS
MANAGEMENT
Shanky GuptaOrganization & Business groups

2. INTRODUCTION
 The Anypoint Platform account allows you to manage the Users and Roles of your
Organization, as well as to configure a federated External Identity from the Access
Management section.
 To access the Organization Administration page:
 Log into an Organization Administrator account.
 Select the Access Management option from the main page, or select it from the left side
bar by clicking the menu button on your top right corner.
 Anypoint Access Management also provides a REST API for you to programmatically
access the resources related to user and client management, organizations and
business groups, and roles and permissions.

3. ORGANIZATION
 As an administrator of an Organization in the Anypoint Platform, there are several
things you can configure for your entire organization such as:
 Invite users to your organization
 Assign users to roles to define their permissions in the platform
 Edit and remove users from your organization
 Configure organization settings
 Access your organization’s client ID and client secret, needed for configuring your API
Gateway instances
 Access analytics for the APIs in your organization
 Create Business Groups to delegate the management of the resources within each of
these and to easily delimit the scopes of roles and permissions. As a Business Group
owner, there are also several things to configure at Business Group level.

4. ORGANIZATION SETTINGS
 The Organization tab displays your organization name, which was created when
your organization was first provisioned. You can edit this name by clicking the
name. The original organization name determines your organization’s portal
domain. However, your portal domain is independently editable as well. Adjusting
the portal domain affects the deep links to any existing API Portals in your
organization.

5. CLIENT ID AND CLIENT SECRET
 Each organization has a client ID and a client secret that authenticate it. These
values are required for configuring an on-premises API Gateway or for
deploying proxies or APIs to an API Gateway hosted on CloudHub.
 To obtain the values of these credentials for your organization, log in to the
Anypoint Platform as an administrator, click the gear icon at the top-right and
then select the Organization tab.

6. MANAGE THE MASTER ORGANIZATION’S SETTINGS
 Organization Admin Only
 As an Admin of your organization, you can modify the organization’s domain and the
session timeout for its users. Access this menu by clicking the Organization link in the
left menu, and selecting the organization name you want to modify.
 Even though multiple organizations can be created by different users using the same
company name, each organization has a unique domain.
 Here you can also consult your organization’s Client Id and Client Secret. These are
useful if you want to use an API Gateway, as you must register it with a specific
organization. The Client Id and Client Secret that belong to the Master Organizaton
provide all of the permissions from the Business Groups within it.
 You can also set a default timeout for owners of accounts in this organization, so that
they have to re-login after a period of inactivity.

7. EXCHANGE SETTINGS
 Organization Admin Only
 You can handle the settings of your Organization’s private branch of the Exchange,
you can edit the Exchange owner’s information and manage the number of items
that your organization is able to expose on it. The URL path is built based on
the Domain Name that you set in the organization’s settings.

8. BUSINESS GROUPS - CREATE A BUSINESS GROUP
 If you have an organization admin role and your
organization is enabled for Business Group
support, you can create Business Groups within
your organization. Just select the Organization
tab, and then click the blue plus sign next to the
Organization name or any Business Groups in the
tree diagram.

9.  You will be prompted to configure several settings for the new Business Group.
You must select a name for it, and assign an existing user in the Organization to be the Business Group
Owner. You can also configure whether this owner will have the ability to create his own Business Groups
branching below this one.
You can assign some or all of the vCores that your organization owns to any individual Business Group so
that these can be used in the CloudHub deployments that are grouped under it. You can assign these
when creating the Business Group, or you can also edit these settings later.

10. CHILD BUSINESS GROUPS
 You can keep splitting a Business Group into
more levels and go as deep as you wish,
by creating Business Groups within a Business Group.
To do so, click the blue plus sign that appears
next to any of the Business Groups at any level:
 If so defined, the owner of a Business Group may be able to create these
independently and can even assign yet another user to be the owner of one of its
child Business Groups. The owner of a parent Business Group will always have
admin rights over any child Business Group below it. Owners of child Business
Groups can’t access or affect anything on its parent Business Groups or the master
organization, this includes access to the parent Business Group’s client ID and
client secret.
 When creating a child Business Group within a parent one, only the vCores that
were assigned to the parent Business Group are eligible for adding into the child.

11. NAVIGATING BETWEEN BUSINESS GROUPS
 Once your organization has multiple Business
Groups, you can easily navigate between them
through the menu on the top-right corner of the
screen. Switching between Business Group
implies that the list of available CloudHub
deployments, the list of available APIs, and all of
the settings regarding users and roles will
correspond to the currently selected Business
Group.
 If you’re not an organization admin user, you will
only see the Business Groups on which your user
has a membership. In the organization tab, the
tree of your organization will also only feature
the Business Groups you’re a member of.

12. CREATING ROLES AND HANDLING MEMBERSHIP TO
BUSINESS GROUPS
 To obtain the membership to a Business Group, a user needs to be granted a role
within that Business Group. Members that are added to a Business Group are then
able to see this Business Group in the top menu and navigate to it.
 Roles may exist at master organization level as well as at Business Group level, these
control different resources. APIs and CloudHub deployments that belong to
a Business Group can only be accessed by being granted roles that belong to that
Business Group, those that belong to the master organization require roles at the
master organization level. Additionally, roles that belong to a Business Group can
only grant access to APIs and CloudHub deployments within that Business Group.
 When adding users to a role that belongs to a Business Group, any users in the
master organization are eligible.

13. DELETING BUSINESS GROUPS
 Only a user who owns an organization administrator role can delete Business
Group.
 No user can delete the root Organization.