diff --git a/cloud/assets/cloud-ravendb-aws-marketplace-landing-page-thank-you.png b/cloud/assets/cloud-ravendb-aws-marketplace-landing-page-thank-you.png
index a23416341a..33ab47fa30 100644
Binary files a/cloud/assets/cloud-ravendb-aws-marketplace-landing-page-thank-you.png and b/cloud/assets/cloud-ravendb-aws-marketplace-landing-page-thank-you.png differ
diff --git a/cloud/assets/cloud-ravendb-aws-marketplace-landing-page.png b/cloud/assets/cloud-ravendb-aws-marketplace-landing-page.png
index 6f49a4ca41..62f95fe703 100644
Binary files a/cloud/assets/cloud-ravendb-aws-marketplace-landing-page.png and b/cloud/assets/cloud-ravendb-aws-marketplace-landing-page.png differ
diff --git a/cloud/assets/cloud-ravendb-azure-marketplace-landing-page-thank-you.png b/cloud/assets/cloud-ravendb-azure-marketplace-landing-page-thank-you.png
index 6a8c928dcc..f4e7796ee2 100644
Binary files a/cloud/assets/cloud-ravendb-azure-marketplace-landing-page-thank-you.png and b/cloud/assets/cloud-ravendb-azure-marketplace-landing-page-thank-you.png differ
diff --git a/cloud/assets/cloud-ravendb-azure-marketplace-landing-page.png b/cloud/assets/cloud-ravendb-azure-marketplace-landing-page.png
index cef5f78079..74c4f8368f 100644
Binary files a/cloud/assets/cloud-ravendb-azure-marketplace-landing-page.png and b/cloud/assets/cloud-ravendb-azure-marketplace-landing-page.png differ
diff --git a/cloud/assets/cluster-health-product-changes-in-time-graph.png b/cloud/assets/cluster-health-product-changes-in-time-graph.png
index 79782220b5..cbbbaeee7f 100644
Binary files a/cloud/assets/cluster-health-product-changes-in-time-graph.png and b/cloud/assets/cluster-health-product-changes-in-time-graph.png differ
diff --git a/cloud/assets/cluster-health-product-changes-in-time-table.png b/cloud/assets/cluster-health-product-changes-in-time-table.png
index b2adc9eaee..697c68243b 100644
Binary files a/cloud/assets/cluster-health-product-changes-in-time-table.png and b/cloud/assets/cluster-health-product-changes-in-time-table.png differ
diff --git a/cloud/assets/cluster-health-suggestions-current-month-above-previous-month-by-numbers.png b/cloud/assets/cluster-health-suggestions-current-month-above-previous-month-by-numbers.png
index 54f9eace65..bb6ff2d9f2 100644
Binary files a/cloud/assets/cluster-health-suggestions-current-month-above-previous-month-by-numbers.png and b/cloud/assets/cluster-health-suggestions-current-month-above-previous-month-by-numbers.png differ
diff --git a/cloud/assets/cluster-health-suggestions-current-month-above-previous-month-by-percents.png b/cloud/assets/cluster-health-suggestions-current-month-above-previous-month-by-percents.png
index 3e0fa46a21..5339779fa9 100644
Binary files a/cloud/assets/cluster-health-suggestions-current-month-above-previous-month-by-percents.png and b/cloud/assets/cluster-health-suggestions-current-month-above-previous-month-by-percents.png differ
diff --git a/cloud/assets/cluster-health-suggestions-current-month-above-threshold-by-percents.png b/cloud/assets/cluster-health-suggestions-current-month-above-threshold-by-percents.png
index 387ddbc746..df640bf5b2 100644
Binary files a/cloud/assets/cluster-health-suggestions-current-month-above-threshold-by-percents.png and b/cloud/assets/cluster-health-suggestions-current-month-above-threshold-by-percents.png differ
diff --git a/cloud/assets/cluster-health-suggestions.png b/cloud/assets/cluster-health-suggestions.png
index aa5d612a4e..8935c65271 100644
Binary files a/cloud/assets/cluster-health-suggestions.png and b/cloud/assets/cluster-health-suggestions.png differ
diff --git a/cloud/assets/login-page-email.png b/cloud/assets/login-page-email.png
deleted file mode 100644
index 099e173e7f..0000000000
Binary files a/cloud/assets/login-page-email.png and /dev/null differ
diff --git a/cloud/assets/login-page-enterprise-sso.png b/cloud/assets/login-page-enterprise-sso.png
new file mode 100644
index 0000000000..9a7161c7b0
Binary files /dev/null and b/cloud/assets/login-page-enterprise-sso.png differ
diff --git a/cloud/assets/login-page-oauth-buttons.png b/cloud/assets/login-page-oauth-buttons.png
index c1f61ae6bb..87f9bc4049 100644
Binary files a/cloud/assets/login-page-oauth-buttons.png and b/cloud/assets/login-page-oauth-buttons.png differ
diff --git a/cloud/assets/portal-backups-database-list.png b/cloud/assets/portal-backups-database-list.png
index 51a721e22d..39abe8a9e1 100644
Binary files a/cloud/assets/portal-backups-database-list.png and b/cloud/assets/portal-backups-database-list.png differ
diff --git a/cloud/assets/portal-backups-restore-link-modal-restore-key.png b/cloud/assets/portal-backups-restore-link-modal-restore-key.png
index 01e0314079..dc6cf67922 100644
Binary files a/cloud/assets/portal-backups-restore-link-modal-restore-key.png and b/cloud/assets/portal-backups-restore-link-modal-restore-key.png differ
diff --git a/cloud/assets/portal-backups-restore-link-modal.png b/cloud/assets/portal-backups-restore-link-modal.png
index 8b6d5fb239..8366a912fd 100644
Binary files a/cloud/assets/portal-backups-restore-link-modal.png and b/cloud/assets/portal-backups-restore-link-modal.png differ
diff --git a/cloud/assets/portal-product-details-migrate-to-data-disk-premium-v2.png b/cloud/assets/portal-product-details-migrate-to-data-disk-premium-v2.png
index 47bef251ea..324c45f222 100644
Binary files a/cloud/assets/portal-product-details-migrate-to-data-disk-premium-v2.png and b/cloud/assets/portal-product-details-migrate-to-data-disk-premium-v2.png differ
diff --git a/cloud/assets/portal-product-details-upgrade-to-premium-v2-modal.png b/cloud/assets/portal-product-details-upgrade-to-premium-v2-modal.png
index 7771ed26e6..c5c14db954 100644
Binary files a/cloud/assets/portal-product-details-upgrade-to-premium-v2-modal.png and b/cloud/assets/portal-product-details-upgrade-to-premium-v2-modal.png differ
diff --git a/cloud/assets/profile-disable-mfa-confirmation.png b/cloud/assets/profile-disable-mfa-confirmation.png
index 650c1ac845..d687a9c829 100644
Binary files a/cloud/assets/profile-disable-mfa-confirmation.png and b/cloud/assets/profile-disable-mfa-confirmation.png differ
diff --git a/cloud/assets/profile-disable-mfa.png b/cloud/assets/profile-disable-mfa.png
index 5b59f6a5a8..6d1722e101 100644
Binary files a/cloud/assets/profile-disable-mfa.png and b/cloud/assets/profile-disable-mfa.png differ
diff --git a/cloud/assets/profile-enable-mfa-configuration.png b/cloud/assets/profile-enable-mfa-configuration.png
index e8032c2994..bd3e16fa12 100644
Binary files a/cloud/assets/profile-enable-mfa-configuration.png and b/cloud/assets/profile-enable-mfa-configuration.png differ
diff --git a/cloud/assets/profile-enable-mfa-phone.png b/cloud/assets/profile-enable-mfa-phone.png
new file mode 100644
index 0000000000..11e98036b1
Binary files /dev/null and b/cloud/assets/profile-enable-mfa-phone.png differ
diff --git a/cloud/assets/profile-enable-mfa-recovery-codes.png b/cloud/assets/profile-enable-mfa-recovery-codes.png
index 53ec97a629..dded03ad1f 100644
Binary files a/cloud/assets/profile-enable-mfa-recovery-codes.png and b/cloud/assets/profile-enable-mfa-recovery-codes.png differ
diff --git a/cloud/assets/profile-enable-mfa.png b/cloud/assets/profile-enable-mfa.png
index 72f7cf30ae..f1259ec64e 100644
Binary files a/cloud/assets/profile-enable-mfa.png and b/cloud/assets/profile-enable-mfa.png differ
diff --git a/cloud/assets/profile-mfa-sso-managed.png b/cloud/assets/profile-mfa-sso-managed.png
new file mode 100644
index 0000000000..e1e9c0f11e
Binary files /dev/null and b/cloud/assets/profile-mfa-sso-managed.png differ
diff --git a/cloud/assets/profile-reset-recovery-codes.png b/cloud/assets/profile-reset-recovery-codes.png
new file mode 100644
index 0000000000..c08de42fc2
Binary files /dev/null and b/cloud/assets/profile-reset-recovery-codes.png differ
diff --git a/cloud/assets/registration-page-billing-information.png b/cloud/assets/registration-page-billing-information.png
index fd6353774d..dc8d138aa7 100644
Binary files a/cloud/assets/registration-page-billing-information.png and b/cloud/assets/registration-page-billing-information.png differ
diff --git a/cloud/assets/registration-page-domain-name-and-account-type.png b/cloud/assets/registration-page-domain-name-and-account-type.png
index fe3e15ae11..e3b32de360 100644
Binary files a/cloud/assets/registration-page-domain-name-and-account-type.png and b/cloud/assets/registration-page-domain-name-and-account-type.png differ
diff --git a/cloud/assets/registration-page-email-address.png b/cloud/assets/registration-page-email-address.png
index c8fa73ce16..a3db3f6ce3 100644
Binary files a/cloud/assets/registration-page-email-address.png and b/cloud/assets/registration-page-email-address.png differ
diff --git a/cloud/assets/registration-page-payment-information.png b/cloud/assets/registration-page-payment-information.png
index 201866b2d6..020c52e1ba 100644
Binary files a/cloud/assets/registration-page-payment-information.png and b/cloud/assets/registration-page-payment-information.png differ
diff --git a/cloud/assets/registration-page-summary.png b/cloud/assets/registration-page-summary.png
index ffcad8b482..06fb998d1e 100644
Binary files a/cloud/assets/registration-page-summary.png and b/cloud/assets/registration-page-summary.png differ
diff --git a/cloud/assets/registration-page-thank-you.png b/cloud/assets/registration-page-thank-you.png
index dc7fc550f4..a2028f7d36 100644
Binary files a/cloud/assets/registration-page-thank-you.png and b/cloud/assets/registration-page-thank-you.png differ
diff --git a/cloud/cloud-account.mdx b/cloud/cloud-account.mdx
index d4ac9af935..3bb414ac72 100644
--- a/cloud/cloud-account.mdx
+++ b/cloud/cloud-account.mdx
@@ -35,8 +35,13 @@ Each account user can be assigned specific roles that extend the range of functi
| API Access | Controls programmatic access to the platform. Generate, manage, and revoke API keys. |
| Support | Create and manage support requests for general issues or specific products, active or terminated. |
| Account | Provides access to general account information. |
-| Account with User Management | Grants permissions to manage account users — invite or remove members, assign their [account roles](#account-roles), and manage their [product permissions](#product-permissions). |
+| Account with User Management | Grants permissions to manage account users — invite or remove members, assign their [account roles](#account-roles), and manage their [product permissions](#product-permissions). With [External SSO](./cloud-sso.mdx#who-can-configure-sso) set up, it also adds SSO users and edits the SCIM group to role mapping. |
| Account with Billing Information | Update credit cards, billing addresses, and payment contacts for your account. |
+| External SSO & User Management | Set up and manage single sign-on (OIDC) and SCIM user provisioning. See [External SSO & User Management](./cloud-sso.mdx). |
+
+
+Account owners hold every role, including **External SSO & User Management**.
+
## Product permissions
@@ -62,7 +67,7 @@ Per-product access is assigned as a single **preset** — you choose one preset
| Admin | Everything a Manager can do, plus terminate the product. Does not include security settings. |
| Security admin | Manages the product's security settings — client certificates, IP allowlists, monitoring IPs, and SNMP credentials. |
-**Security admin** is an **add-on** enabled on top of a base preset (Viewer / Operator / Manager / Admin) with a dedicated toggle. It cannot be enabled for **No access**, and it cannot be toggled for a **Custom (legacy)** access level — an access level that predates the presets, shown (and locked) when editing such a user.
+**Security admin** is an **add-on** enabled on top of a base preset (Viewer / Operator / Manager / Admin). It is a switch at the bottom of each product's access-level menu, and an icon next to the selected level shows when it is on. It cannot be enabled for **No access**, and it cannot be toggled for a **Custom (legacy)** access level — an access level that predates the presets, shown (and locked) when editing such a user.
The **Monitoring/OpenTelemetry** and **Power BI** features are a special case. **Enabling or disabling** them requires the **Manager** (or **Admin**) preset **together with** the **Security admin** add-on. To only **configure** such a feature once it is enabled, the **Security admin** add-on is sufficient.
@@ -86,7 +91,7 @@ Permissions are assigned from the [Users & Access](./portal/cloud-portal-users-a
Each account member carries a per-user **default product-permission set**. When a new product is provisioned, every member whose default is non-empty is automatically granted those permissions on the new product. A member with an empty default receives no access (this is the out-of-the-box value).
-* The default is set by the **Account Owner** only, in the invite-user and edit-user flows. Users with the **Account with User Management** role can manage per-product permissions, but they cannot change a user's default access for new products.
+* The default is set by the **Account Owner** only, in the **New products** section of the invite-user and edit-user panels. Users with the **Account with User Management** role can manage per-product permissions, but they cannot change a user's default access for new products.
* It applies only to products created **after** it is set — it does not retroactively change access to existing products.
diff --git a/cloud/cloud-aws-marketplace.mdx b/cloud/cloud-aws-marketplace.mdx
index 6dd8b238e3..79a49babf0 100644
--- a/cloud/cloud-aws-marketplace.mdx
+++ b/cloud/cloud-aws-marketplace.mdx
@@ -77,6 +77,9 @@ Provide the necessary information required to end the registration process:
+The **Customer Identifier** and **AWS Account ID** at the top of the page are filled in from your *AWS* subscription.
+You only need them to [convert an existing Cloud account](../cloud/cloud-aws-marketplace.mdx#conversion-from-a-regular-cloud-account-to-an-aws-marketplace-account) to this subscription.
+
1. **Email Address**
Provide an email address that you will use in RavenDB Cloud.
@@ -124,5 +127,6 @@ Successful cancellation process is also confirmed by an email from *AWS Marketpl
## Conversion from a regular Cloud Account to an AWS Marketplace Account
-If you would like to convert your existing *Cloud Account* to an *AWS Marketplace Account* to pay for your services using a credit card associated with your *AWS* account, please submit a support request from Cloud Account owner via the *RavenDB Cloud Portal*.
+If you would like to convert your existing *Cloud Account* to an *AWS Marketplace Account* to pay for your services using a credit card associated with your *AWS* account, please submit a support request from Cloud Account owner via the *RavenDB Cloud Portal*.
+Include the **Customer Identifier** and **AWS Account ID** shown on the RavenDB Cloud page you reach from *AWS Marketplace* after subscribing.
diff --git a/cloud/cloud-backup-and-restore.mdx b/cloud/cloud-backup-and-restore.mdx
index e1b447bdcc..34f7440784 100644
--- a/cloud/cloud-backup-and-restore.mdx
+++ b/cloud/cloud-backup-and-restore.mdx
@@ -76,7 +76,7 @@ Key constraints to keep in mind:
- On undersized tiers the backup job may time out, be terminated due to memory exhaustion,
or fail mid-run — leaving you without a usable recovery point.
-**Example:** A product running on a **PS10** (entry-level Performance tier) that hosts a
+**Example:** A product running on a **PS10** (the smallest Production instance type) that hosts a
**500 GB database** will reliably fail to complete backups. The instance does not have enough
resources — disk IOPS, memory, or both — to snapshot a database of that size. Customers in this
situation must upgrade to a higher tier before backups can succeed.
@@ -201,28 +201,33 @@ Backup files that have already been created, are listed in the backups tab.
* Open your portal's Backups tab, and choose the product whose database you want to restore.
Its backups will be shown, listed by the databases they've been created for.
* Click "Generate Restore Link" for the database you want to restore.
- The backup link window will open.
+ The **Restore Link** dialog will open.
#### Restore the Database
Clicking the **Generate Restore Link** button will show you a simple procedure. Follow it to restore your database.
-
+
-* **A.** Create a **New Database From Backup**
+The restore link is valid for **2 hours** by default. The dialog also estimates how long the restore will take,
+based on the size of the backup. If you need more time, pick a validity of up to **36 hours** in **Token Expiration**
+and click **Regenerate restore link**.
+
+* **Steps 1-3.** Create a **New Database From Backup**
-* **B.** Choose **Cloud** as your Source
+* **Step 4.** Choose **Cloud** as your Source
-* **C.** Copy the Backup Link you've been given in the Backups Tab, to the **Backup Link** box here.
+* **Step 5.** Copy the Restore Link you've been given in the Backups Tab, to the **Backup Link** box here.
-* **D.** Choose a **Restore Point**
+* **Step 6.** Choose a **Restore Point**
-* **E.** Encryption Key for an **Encrypted** Database
- If your original database **is** encrypted, its backup has been encrypted with the same key. Find it and paste it here.
- 
-* **F.** Encryption Key for an **Unencrypted** Database
- If your original database is **not** encrypted, we used your account-wide encryption key to encrypt your backup file.
- Copy it from the right Backups Tab box.
- 
+* **Step 7.** Provide the key that decrypts the backup:
+ * **Snapshot backup of an encrypted database**
+ The backup has been encrypted with the database's own key. Find it and paste it here.
+ 
+ * **Standard backup, or a database that is not encrypted**
+ We used your account-wide encryption key to encrypt your backup file.
+ Click **Show** next to the **restore key** in the dialog, or **Copy to clipboard**, and paste it here.
+ 
diff --git a/cloud/cloud-features.mdx b/cloud/cloud-features.mdx
index 73e3f2b9b0..9a6f7093d1 100644
--- a/cloud/cloud-features.mdx
+++ b/cloud/cloud-features.mdx
@@ -200,15 +200,27 @@ You can read step by step OpenTelemetry & Grafana configuration [here](https://r
*RavenDB Cloud* can resize your instance automatically, within a range you choose, so it follows your actual workload
instead of being fixed to the size you provisioned.
-Scaling is driven by three sustained signals, each watched independently:
+Scaling is driven by three sustained signals:
* **Load average** — how busy the node's CPUs are.
* **Available memory** — how much memory is left for processing.
* **IO wait** — how much time the node spends waiting on disk.
-Each signal has a low and a high limit, and each limit has its own duration. A limit must be breached for the whole of
-its duration before it counts, and a **grace period** then applies before the resize itself, so a brief spike never
-moves your instance.
+Each signal has a low and a high limit, and each limit has its own duration. Load average and available memory are
+averaged over that duration, and IO wait must stay past its limit for the whole of it, so a brief spike never moves
+your instance.
+
+The two directions combine the signals differently:
+
+* **Scaling up** takes one signal on one node. The cluster scales up when **any node** has a load average at or above
+ the high limit, available memory at or below the low limit, **or** IO wait above the max value.
+* **Scaling down** takes all three signals on every node. The cluster scales down only when **every node** has a load
+ average at or below the low limit, available memory at or above the high limit, **and** IO wait at or below the min
+ value.
+
+Each direction also has a **grace period**: a cooldown counted from the moment the last resize finished, including a
+resize you made yourself. The cluster does not scale up until the upscaling grace period has passed since then, and
+does not scale down until the downscaling grace period has passed.
### Autoscaling range
@@ -226,7 +238,7 @@ split into upscaling and downscaling parameters.
| Parameter | Range | Description |
|--------------------------------------|-------------|------------------------------------------------------------------------------------------------------|
-| Upscaling grace period | 3–60 min | The delay before upscaling begins after a high resource threshold is exceeded, so short spikes do not trigger a resize. |
+| Upscaling grace period | 3–1440 min | The minimum time after the last resize, including a manual one, before the cluster can scale up again. |
| High load average threshold | 50–90% | The average load percentage, over the *high load average threshold duration*, that triggers upscaling. |
| High load average threshold duration | 180–600 sec | How long the average load must stay above the threshold before upscaling is triggered. |
| Low available memory threshold | 1–15% | The available memory percentage below which upscaling is triggered. |
@@ -239,7 +251,7 @@ split into upscaling and downscaling parameters.
| Parameter | Range | Description |
|-------------------------------------|-------------|-------------------------------------------------------------------------------------------------------|
-| Downscaling grace period | 3–60 min | The delay before downscaling begins after a low resource threshold is reached. |
+| Downscaling grace period | 3–1440 min | The minimum time after the last resize, including a manual one, before the cluster can scale down again. |
| Low load average threshold | 1–35% | The average load percentage, over the *low load average threshold duration*, that triggers downscaling. |
| Low load average threshold duration | 180–600 sec | How long the average load must stay below the threshold before downscaling is triggered. |
| High available memory threshold | 20–90% | The available memory percentage above which downscaling is allowed. |
diff --git a/cloud/cloud-instances.mdx b/cloud/cloud-instances.mdx
index 3b10b38b1f..69f84ca1af 100644
--- a/cloud/cloud-instances.mdx
+++ b/cloud/cloud-instances.mdx
@@ -111,7 +111,8 @@ with configurations that suit your needs.
*Production tier* clusters can be also extended by [additional product nodes](../cloud/portal/cloud-portal-products-tab.mdx#nodes-additional-product-nodes).
-This option is not available for **PS** instance types.
+This option is not available for **PS** and **PN** instance types, for Serverless products, or for
+products on a yearly contract.
@@ -216,8 +217,8 @@ For instructions on how to create a Serverless product, see
### Autoscaling
The cluster scales up and down automatically within a band you choose, driven by three sustained signals:
-**load average**, **available memory** and **IO wait**. Scaling moves one step at a time, and a grace period is applied
-before each step to prevent flapping caused by short load spikes.
+**load average**, **available memory** and **IO wait**. Scaling moves one step at a time, a signal counts only once it
+has been sustained, and a grace period after each resize keeps the cluster from flapping between sizes.
Serverless Autoscaling is always enabled, and only its instance range — the lowest and highest type — is configurable;
the thresholds and grace periods are managed for you. See
diff --git a/cloud/cloud-maintenance-troubleshooting.mdx b/cloud/cloud-maintenance-troubleshooting.mdx
index 1b7b9bc5e3..34e6a3cb76 100644
--- a/cloud/cloud-maintenance-troubleshooting.mdx
+++ b/cloud/cloud-maintenance-troubleshooting.mdx
@@ -118,13 +118,14 @@ Suggestions are generated based on a 60-day period divided in half.
#### Suggestion types
-**Cluster Health** is able to generate suggestions for *five* usage areas:
+**Cluster Health** is able to generate suggestions for *six* usage areas:
- High CPU usage
- High IO usage
- Low memory mode
- Low CPU credits
- Server restarted due to Out of Memory
+- Not responding
#### Analyses
@@ -132,9 +133,9 @@ Suggestions are generated using three types of analyses for specific suggestion
| Analyse type | Applicable to | Description |
|--------------------------------------------------|-----------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------|
-| Current period above previous period by percents | High CPU usage, High IO usage, Low memory mode, Low CPU credits | The duration of a specific event was longer in the current period than in the previous period. |
-| Current period above previous period by numbers | Server restarted due to Out of Memory | The number of occurrences of a specific event was higher in the previous period than in the current period. |
-| Current period above threshold by percents | High CPU usage, High IO usage, Low memory mode, Low CPU credits | The duration of a specific event in the current period was longer than the threshold (5%). |
+| Current period above previous period by percents | High CPU usage, High IO usage, Low memory mode, Low CPU credits, Not responding | The duration of a specific event was longer in the current period than in the previous period, by at least 4 percentage points (0.01 for Not responding). |
+| Current period above previous period by numbers | Server restarted due to Out of Memory | The number of occurrences of a specific event was higher in the current period than in the previous period, by at least 4. |
+| Current period above threshold by percents | High CPU usage, High IO usage, Low memory mode, Low CPU credits, Not responding | The duration of a specific event in the current period was longer than the threshold (5%; 0.01% for Not responding). |
Below examples of the suggestions with the analyses:
@@ -169,7 +170,15 @@ A product can have **at most one** daily summary.
* It covers **every** trigger event, so there is nothing to choose - the panel lists them all for reference.
* The email groups the events by name and includes the counts for the period.
-* It also carries the current [Suggestions](#suggestions) for the product, when there are any.
+* It also lists **suggestions** worked out from **that day's events only** - not the 30-day
+ [Suggestions](#suggestions) shown on the Cluster Health page. A node gets a suggestion when, in the
+ last 24 hours, it had:
+ * *High CPU usage* for at least **5%** of the time,
+ * *High IO usage* for at least **3%** of the time,
+ * *Low memory mode* for at least **2%** of the time, or
+ * any *Low CPU credits*, *Not responding* or *Server restarted due to Out of Memory* event.
+* Only the part of an event that falls within the period counts. A suggestion whose event is still in
+ progress when the email is sent is marked as ongoing.
* If nothing happened in the period, **no email is sent** - a daily summary never arrives empty.
### Custom alerts
diff --git a/cloud/cloud-overview.mdx b/cloud/cloud-overview.mdx
index cb44651d17..03c05b75c7 100644
--- a/cloud/cloud-overview.mdx
+++ b/cloud/cloud-overview.mdx
@@ -36,6 +36,7 @@ like adding or removing nodes, and run recurring tasks like backing up your data
- [Login](../cloud/cloud-overview.mdx#login-to-your-account)
- [Login with a magic link](../cloud/cloud-overview.mdx#login-with-a-magic-link)
- [Login with Google, GitHub or Microsoft](../cloud/cloud-overview.mdx#login-with-google-github-or-microsoft)
+ - [Login with External SSO](../cloud/cloud-overview.mdx#login-with-external-sso)
* [RavenDB on the Cloud](../cloud/cloud-overview.mdx#ravendb-on-the-cloud)
* [Instances, Provisioning and RavenDB Products](../cloud/cloud-overview.mdx#instances-provisioning-and-ravendb-products)
* [RavenDB Tiers: Free, Development and Production](../cloud/cloud-overview.mdx#ravendb-tiers)
@@ -113,7 +114,10 @@ Click the **Skip Billing Information** button if you prefer to evaluate the clou
#### 5. Summary
-- Verify your choices, confirm you're not a robot, and click the **Create account** button to register your cloud account.
+- Verify your choices.
+- If you have a promo code, enter it under **Redeem offer** and click **Apply**.
+ Some promo codes require billing information. If you skipped it, the page asks you to enter it or to try another code.
+- Confirm you're not a robot, and click the **Create account** button to register your cloud account.
- You’ll receive an email with sign in link which allows you to sign in to the RavenDB Cloud portal.
@@ -129,13 +133,19 @@ Click the **Skip Billing Information** button if you prefer to evaluate the clou
To access your account, click [https://cloud.ravendb.net/user/login](https://cloud.ravendb.net/user/login).
-You can sign in either with a **magic link** sent to your email, or by using your
-**Google**, **GitHub** or **Microsoft** account.
+You can sign in with a **magic link** sent to your email, or by using your
+**Google**, **GitHub** or **Microsoft** account. If your organization has set up
+[External SSO](../cloud/cloud-sso.mdx), you sign in through your organization's identity provider instead.
+
+
+
+The links at the bottom of the sign-in pages open the **Terms of Use**, the **Privacy Policy** and the
+**Cookie settings**.
+
#### Login with a magic link
-
- Enter the same email address you provided during registration, confirm you're not a robot, and
- click the **Send Magic Link** button
+ click the **Continue with email** button
* The login procedure will send you a message with a link. Click the link to enter your account, no password required.
@@ -144,10 +154,6 @@ You can sign in either with a **magic link** sent to your email, or by using you
The magic link is expirable to make sure each visit is logged and keep account activity trackable and more secure.
-
- An account can currently be managed by a single operator, we will soon add multiple-operators management.
-
-
We advise you to enable 2FA. Setup is described [here](../cloud/cloud-security.mdx#enable-mfa).
@@ -156,9 +162,8 @@ You can sign in either with a **magic link** sent to your email, or by using you
In addition to the magic link, you can sign in using your **Google**, **GitHub** or **Microsoft**
account. The login page shows **Sign in with Google**, **Sign in with GitHub** and
-**Sign in with Microsoft** buttons below the magic-link form.
-
-
+**Sign in with Microsoft** buttons below the magic-link form, together with the
+[**Sign in with External SSO**](../cloud/cloud-overview.mdx#login-with-external-sso) button.
- Click the button for the provider you want to use.
- Authorize RavenDB Cloud at that provider.
@@ -166,8 +171,8 @@ account. The login page shows **Sign in with Google**, **Sign in with GitHub** a
reported by the provider.
-Your RavenDB Cloud account is identified by **email address**. Single sign-on only succeeds when the
-email reported by the provider matches the email of an existing Cloud account.
+Your RavenDB Cloud account is identified by **email address**. Signing in with Google, GitHub or Microsoft
+only succeeds when the email reported by the provider matches the email of an existing Cloud account.
@@ -212,7 +217,7 @@ If sign-in cannot be completed you stay on the login page with an explanation. T
You can always fall back to the [magic link](../cloud/cloud-overview.mdx#login-to-your-account) sign-in.
-Users are responsible for enabling and maintaining Two-Factor Authentication (2FA) on their designated Single Sign-On (SSO) provider.
+Users are responsible for enabling and maintaining Two-Factor Authentication (2FA) at the provider they sign in with - Google, GitHub or Microsoft.
**No Cloud account for the email**
@@ -223,6 +228,21 @@ link opens the registration form with the email pre-filled, so you can finish cr
+#### Login with External SSO
+
+If your organization has set up [External SSO & User Management](../cloud/cloud-sso.mdx), you sign in
+through your organization's identity provider:
+
+- Click **Sign in with External SSO** on the login page.
+- Enter your **Account domain** and click **Continue with SSO**.
+- Sign in at your identity provider. You are returned to the RavenDB Cloud Portal.
+
+
+
+Your administrator can also give you a sign-in link that fills in the account domain for you.
+External SSO only signs in users your administrator has added or your identity provider has provisioned.
+See [Signing in with SSO](../cloud/cloud-sso.mdx#signing-in-with-sso).
+
## RavenDB on the Cloud
## Instances, Provisioning and RavenDB Products
@@ -269,7 +289,7 @@ HW selection or a multi-region cluster.
| -- | -- | -- | -- | -- |
| Free | - | Very low | None | No |
| Development | Dev10-Dev70 | Very low - High | All | [Yes](../cloud/cloud-support.mdx#available-support-options) |
-| Production | **By CPU Priority** (Basic/Standard/Performance)
**By Cluster Size**| Up to extra performance, high network and reserved NVMe | All | [Yes](../cloud/cloud-support.mdx#available-support-options) |
+| Production | **By CPU Priority** (Shared/Basic/Standard/Performance)
**By Cluster Size**| Up to extra performance, high network and reserved NVMe | All | [Yes](../cloud/cloud-support.mdx#available-support-options) |
## Burstable vs. Reserved clusters
@@ -289,8 +309,10 @@ If you expect moderate usage (with some peaks), choosing a burstable option can
Upgrading from Burstable to Reserved
-The RavenDB Cloud allows you to upgrade from a **Basic** production instance to a **Standard** or
-**Performance** cluster at will, with no impact on your system availability.
+The RavenDB Cloud allows you to upgrade from a **Basic** production instance to a **Standard**
+cluster at will, with no impact on your system availability.
+Moving to a **Performance** cluster requires a new product and a data migration - see
+[Change Instance Type](../cloud/cloud-scaling.mdx#scaling---change-instance-type).
## Budget, Credits and Throttling
diff --git a/cloud/cloud-pricing-payment-billing.mdx b/cloud/cloud-pricing-payment-billing.mdx
index 355d3586e3..dfff07d209 100644
--- a/cloud/cloud-pricing-payment-billing.mdx
+++ b/cloud/cloud-pricing-payment-billing.mdx
@@ -30,7 +30,7 @@ details in any case). You can pay per minute without any commitment, or use one
* [Billing](../cloud/cloud-pricing-payment-billing.mdx#billing)
- [Billing Period](../cloud/cloud-pricing-payment-billing.mdx#billing-period)
- [Charging Failures](../cloud/cloud-pricing-payment-billing.mdx#charging-failures)
- - [Pay Now](../cloud/cloud-pricing-payment-billing.mdx#pay-now)
+ - [Retry a failed payment](../cloud/cloud-pricing-payment-billing.mdx#pay-now)
@@ -168,29 +168,29 @@ you and retry for 5 days. Failure to pay after that period may result in account
Here's an example of the notification sent to the owner and all cloud account managers:
-#### Pay Now
+#### Retry a failed payment {#pay-now}
-The `Pay Now` button becomes visible on your Billing tab dashboard once there are any unpaid costs from previous billing cycle(s).
+Once there are unpaid costs from previous billing cycles, the Billing & Costs tab shows a *We couldn't process your payment* banner with the date of the oldest unpaid cost, the total due, and a **Retry payment** button.
After a failed charge attempt, another attempt can be made after **60** minutes.
-If you have resolved the issue associated with the charge failure (e.g., updated payment information), you can manually initiate the payment by clicking the `Pay Now` button.
-Upon clicking the `Pay Now` button, the system will process the payment for all outstanding amounts up to the end of the previous billing cycle. If the payment process fails, you will be notified again by email.
+If you have resolved the issue associated with the charge failure (e.g., updated payment information), you can initiate the payment yourself: click **Retry payment**, check the amount in the *Confirm payment* dialog, and click **Confirm and pay**.
+The system then processes the payment for all outstanding amounts up to the end of the previous billing cycle. If the payment process fails, you will be notified again by email.
-
-
+
+
#### Billing Cycle and Date Range
-The `Pay Now` feature covers all unpaid costs up to the end of the previous billing cycle.
+A retried payment covers all unpaid costs up to the end of the previous billing cycle.
It does not cover costs incurred in the current billing cycle.
#### Example
-If you have unpaid costs from 13/12/2023 and today is 01/03/2024, using the `Pay Now` feature will bill you for the period from **13/12/2023** up to **27/02/2024**.
+If you have unpaid costs from December 13, 2023 and today is March 1, 2024, retrying the payment will bill you for the period from **December 13, 2023** up to **February 25, 2024**.
#### Notifications
@@ -201,7 +201,7 @@ If you have unpaid costs from 13/12/2023 and today is 01/03/2024, using the `Pay
Ensure that your payment information is up-to-date to avoid repeated charge failures.
-Contact support if you encounter any issues while using the `Pay Now` feature.
+Contact support if you encounter any issues while retrying a payment.
diff --git a/cloud/cloud-scaling.mdx b/cloud/cloud-scaling.mdx
index e049ed60bd..a23043f1e8 100644
--- a/cloud/cloud-scaling.mdx
+++ b/cloud/cloud-scaling.mdx
@@ -75,6 +75,7 @@ To avoid IO throttling by the instance type, make sure to use an instance type a
Use the **CPU Priority** and **Cluster Size** slide bars to compose a configuration
that would allow your product to properly handle its expected workload.
+The **CPU Priority** slide bar offers only the priorities your product can switch to.
Scaling product to P60 or P70 can be done only via support request.
@@ -86,6 +87,12 @@ You can upscale or downscale only within the current Product Tier. The *Developm
for example, can upscale to **Dev50**, but not to the Production Tier **PB10** configuration.
Your databases and data will be automatically migrated into your new configuration.
+Within the Production Tier, a product cannot switch between **Performance** (PN) instance types and the
+other CPU priorities (**Shared**, **Basic** and **Standard**), in either direction. PN instances keep
+their data on ephemeral local NVMe disks, so moving to Performance requires a new PN product and a data
+migration. A PN product cannot change its instance type in the Portal; to scale it up, open a
+[support request](../cloud/cloud-support.mdx).
+
Once you upscale or downscale, you will receive an email notification of this operation.
@@ -97,6 +104,16 @@ depending on the cloud provider in question. Pick either to change your current
+**Switching between Standard and Premium** keeps your current capacity, even when it is larger than your
+instance type offers for new disks. This applies to AWS and Azure products whose data is on the main
+disk; products with a separate data disk cannot switch the storage type, and neither can Serverless
+products, which use Standard storage only.
+
+* The other type starts at its default performance for that capacity.
+* Switching back to your current type restores your current IOPS, throughput and *Performance Tier*.
+* When you change the **capacity**, your IOPS are kept within the range the new size allows, and a raised
+ Azure *Performance Tier* is kept as long as the new size still offers it.
+
Storage can also grow **on its own**: with
[Automatic Storage Extension](./cloud-features.mdx#automatic-storage-extension) enabled, the disk is extended to the
@@ -130,7 +147,7 @@ The cost per IOPS is dependent on the selected region.
#### Azure Standard & Premium - Default Performance
The performance of **Standard** Disks is always the same, regardless of Disk size.
-The parameters are **500 IOPS** and **60 MB/s** of **Throughput**.
+The parameters are **500 IOPS** and **100 MB/s** of **Throughput**.
The performance of **Premium** Disks increases with their size.
@@ -142,6 +159,9 @@ level of performance, the **Premium** Disk type on **Azure** lets you use a high
long as you need it. This feature allows you to increase the disk performance without increasing the disk size.
You can then return to the original Tier when you no longer need the additional performance.
+Changing only the *Performance Tier* is applied without stopping the node, so it causes no downtime -
+also on a single-node Development product.
+
@@ -233,7 +253,8 @@ The *Production Tier* products can be expanded by adding *additional nodes* to t
-This option **is not available** for **PS** instance types.
+This option **is not available** for **PS** and **PN** instance types, for Serverless products, or for
+products on a yearly contract.
The maximum number of additional nodes that can be added equals **3**.
Nodes *A*, *B*, *C* **cannot be removed**.
diff --git a/cloud/cloud-security.mdx b/cloud/cloud-security.mdx
index 77c72459c9..dbd1aa9933 100644
--- a/cloud/cloud-security.mdx
+++ b/cloud/cloud-security.mdx
@@ -23,7 +23,9 @@ import LanguageContent from "@site/src/components/LanguageContent";
* [Using additional certificates](cloud-security#using-additional-certificates)
* [MFA](../cloud/cloud-security.mdx#mfa)
- [Enable MFA](../cloud/cloud-security#enable-mfa)
+ - [Recovery codes and phone number](../cloud/cloud-security#recovery-codes-and-phone-number)
- [Disable MFA](../cloud/cloud-security#disable-mfa)
+ - [MFA for SSO users](../cloud/cloud-security#mfa-for-sso-users)
@@ -138,43 +140,79 @@ Components of Multi-Factor Authentication:
By utilizing these components of MFA, users can significantly enhance the security of their accounts and mitigate the
risk of unauthorized access.
+MFA is managed on the **Security** page of your profile: open the profile menu at the bottom of the
+[Portal sidebar](../cloud/portal/cloud-portal.mdx#profile) and select **Security**, or go to
+[https://cloud.ravendb.net/portal/profile/security](https://cloud.ravendb.net/portal/profile/security).
+
### Enable MFA
-To enable Multi-Factor Authentication either visit
-the [enable-authenticator](https://cloud.ravendb.net/portal/profile/enable-authenticator) page
-or open your RavenDB Cloud [Profile](https://cloud.ravendb.net/portal/profile).
+
-
+1. In the **Authenticator app** card, turn on the **Enable 2FA** switch.
+2. *Only if you have no recovery phone number yet:* the *Set your recovery phone number* dialog opens
+ first. Enter your number and click **Next**.
-1. Click the **Add authenticator app** button.
+
-
+
-2. Scan the provided QR code or enter the provided text code into an authentication app of your choice.
-3. Type in the 2FA code generated by your authentication app.
-4. Type in a recovery phone number.
+3. Scan the QR code with an authenticator app of your choice, or copy the secret and paste it into the app.
+4. Enter the 6-digit code that the app generates.
5. Click **Verify**.
-After verifying, you will be provided with recovery codes. Save them in a secure place.
+6. Save the 10 recovery codes in a secure place — download them as a file or copy them — and click **Done**.
+
MFA is now enabled on your account.
-### Disable MFA
+### Recovery codes and phone number
+
+While MFA is on, the **Recovery codes** card on the Security page tracks your unused recovery codes.
+Each code works once.
+
+* When **3 or fewer** codes are left, the card shows an alert with a link to generate a new set: a
+ warning at 3 and 2 codes, a red alert at 1 and 0. With **none** left, you can no longer sign in with a
+ recovery code.
+* Click **Reset recovery codes** to create a new set. Your old codes stop working as soon as the new ones
+ are created.
+
+
+
+The **Recovery phone number** section shows your number, with **Add number** or **Edit number** to set it.
+The phone number is the last-resort way to identify you if all other security methods are lost; using
+it requires a [Support](../cloud/cloud-support.mdx) request.
-To disable Multi-Factor Authentication either visit
-the [disable-authenticator](https://cloud.ravendb.net/portal/profile/disable-2fa) page
-or open your RavenDB Cloud [Profile](https://cloud.ravendb.net/portal/profile).
+If you selected **Remember me** when you last signed in with a 2FA code, a **Forget this browser** link
+appears on the Security page. Click it to be asked for a code again at your next sign-in from this
+browser.
-
+### Disable MFA
+
+
-1. Click the **Disable 2FA** button.
+1. In the **Authenticator app** card, turn off the **Enable 2FA** switch.
-
+
-2. Type in the 2FA code generated by your authentication app.
+2. In the **Disable two-factor authentication** dialog, type the code generated by your authenticator app.
3. Click **Disable 2FA**.
+Disabling MFA removes the keys used by your authenticator app and invalidates your recovery codes.
+
-For security reasons you will be logged out once you disable 2FA.
+For security reasons you will be logged out once you disable 2FA. The login page then shows
+*Two-factor authentication is off. Sign in again to continue.*
+
+### MFA for SSO users
+
+Users who sign in through [External SSO](../cloud/cloud-sso.mdx) cannot turn on RavenDB Cloud 2FA.
+Their Security page shows a *Managed by your identity provider* badge instead of the **Enable 2FA**
+switch: multi-factor authentication for them is configured and enforced at your organization's
+identity provider.
+
+
+
+If an SSO user already had RavenDB Cloud 2FA turned on, the **Enable 2FA** switch stays next to the
+badge, so they can turn 2FA off. Signing in through SSO does not ask them for the 2FA code.
diff --git a/cloud/cloud-sso.mdx b/cloud/cloud-sso.mdx
new file mode 100644
index 0000000000..5bc8791bc4
--- /dev/null
+++ b/cloud/cloud-sso.mdx
@@ -0,0 +1,374 @@
+---
+title: "Cloud: External SSO & User Management"
+sidebar_label: External SSO
+description: "Sign in to RavenDB Cloud through your organization's OpenID Connect identity provider, and optionally provision users and map groups to roles with SCIM 2.0."
+sidebar_position: 11
+---
+
+import Admonition from '@theme/Admonition';
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+import CodeBlock from '@theme/CodeBlock';
+import LanguageSwitcher from "@site/src/components/LanguageSwitcher";
+import LanguageContent from "@site/src/components/LanguageContent";
+
+# Cloud: External SSO & User Management
+
+
+**External SSO & User Management** lets your team sign in to RavenDB Cloud through your organization's own
+identity provider (IdP) — Okta, Microsoft Entra ID, Google, or any other OpenID Connect (OIDC) provider.
+Optionally, the identity provider can also create, update and deactivate those users automatically
+through **SCIM 2.0**, and map its groups to RavenDB Cloud roles.
+
+Authentication stays with your identity provider. Authorization stays in RavenDB Cloud: what a user may
+do is still decided by [account roles](../cloud/cloud-account.mdx#account-roles) and
+[product permissions](../cloud/cloud-account.mdx#product-permissions).
+
+* In this page:
+ * [Availability](../cloud/cloud-sso.mdx#availability)
+ * [Who can configure SSO](../cloud/cloud-sso.mdx#who-can-configure-sso)
+ * [Management types](../cloud/cloud-sso.mdx#management-types)
+ * [Identity provider requirements](../cloud/cloud-sso.mdx#identity-provider-requirements)
+ * [Connect your identity provider](../cloud/cloud-sso.mdx#connect-your-identity-provider)
+ * [Provider setup guides](../cloud/cloud-sso.mdx#provider-setup-guides)
+ * [SCIM provisioning](../cloud/cloud-sso.mdx#scim-provisioning)
+ * [Group to role mapping](../cloud/cloud-sso.mdx#group-to-role-mapping)
+ * [Signing in with SSO](../cloud/cloud-sso.mdx#signing-in-with-sso)
+ * [Managing the connection](../cloud/cloud-sso.mdx#managing-the-connection)
+ * [Troubleshooting](../cloud/cloud-sso.mdx#troubleshooting)
+
+
+
+## Availability
+
+The feature is listed under **Account features** in the Portal [sidebar](../cloud/portal/cloud-portal.mdx#sidebar-views),
+on the **External SSO & User Management** card.
+
+External SSO & User Management has to be activated for your account by RavenDB Cloud before you can
+configure it. Until then, the card shows a **Not available** badge and a **Contact sales** button that
+opens an email to our sales team.
+
+Once the feature is activated:
+
+* **Not configured** — click **Configure** to open the [connect wizard](../cloud/cloud-sso.mdx#connect-your-identity-provider).
+* **Configured** — click **Manage** to open the SSO settings page.
+
+The card's **See documentation** link opens this page.
+
+
+
+## Who can configure SSO
+
+| **Role** | **What it allows** |
+|----------|--------------------|
+| **External SSO & User Management** | Everything on this page: create and edit the connection, generate and revoke SCIM tokens, change the management type, reset identity links, and disable SSO. Account owners hold this role. |
+| **Account with User Management** | Once a connection exists: open the SSO settings and edit the [group to role mapping](../cloud/cloud-sso.mdx#group-to-role-mapping). In *Sign-in only* mode, add SSO users on the [Users & Access](../cloud/portal/cloud-portal-users-and-access-tab.mdx) page. It cannot change the connection, the SCIM tokens or the management type. |
+
+A member without the **External SSO & User Management** role who opens a card that is not configured
+yet sees *An account admin needs to set this up first.*
+
+See [Account roles](../cloud/cloud-account.mdx#account-roles) for the full list of roles.
+
+## Management types
+
+You choose one of two management types when you connect your identity provider.
+
+| | **Sign-in only** | **Sign-in and user provisioning (SCIM)** |
+|---|---|---|
+| Who signs users in | Your identity provider | Your identity provider |
+| Who creates SSO users | You, on the [Users & Access](../cloud/portal/cloud-portal-users-and-access-tab.mdx) page (**Add new SSO user**) | Your identity provider, through SCIM |
+| Who removes SSO users | You, on the Users & Access page | Your identity provider (deactivating or unassigning a user) |
+| Where SSO users' roles are set | Users & Access | Your identity provider's groups, through the [group to role mapping](../cloud/cloud-sso.mdx#group-to-role-mapping) |
+| Required at the identity provider | OpenID Connect | OpenID Connect and outbound SCIM 2.0 |
+
+
+An **SSO user** signs in only through your identity provider. A **Cloud user** signs in with a magic link
+or with Google, GitHub or Microsoft, as described in [Login](../cloud/cloud-overview.mdx#login-to-your-account).
+
+Turning SSO on does not remove Cloud users: existing members keep their access, and you can still invite
+new Cloud users in either management type. Deprovisioning someone at your identity provider removes only
+their SSO user, not a Cloud user the same person may also have. If you want your identity provider to
+be the only way into the account, remove the other Cloud members yourself.
+
+
+
+You can switch between the two types later from the SSO settings page (**Change management type**).
+The switch asks you to type your account domain to confirm, because it **permanently removes every
+SSO user** on the connection. Leaving *Sign-in and user provisioning (SCIM)* also deletes the SCIM
+tokens, the discovered groups and the group mapping. When you switch to SCIM, your identity provider
+re-creates the users it manages on its next push.
+
+
+## Identity provider requirements
+
+Any identity provider that implements the standard OpenID Connect authorization code flow works, as
+long as it meets these requirements:
+
+| **Requirement** | **Details** |
+|-----------------|-------------|
+| Discovery document | The issuer must serve `/.well-known/openid-configuration`. All endpoints are read from it; they cannot be entered by hand. |
+| HTTPS issuer | The issuer must use HTTPS and a public host name — not an IP address, and no user name or password in the URL. Redirects from the discovery or token endpoint are not followed. |
+| Client authentication | The client ID and secret are sent in the request body (`client_secret_post`). A provider that accepts only HTTP Basic client authentication (`client_secret_basic`) fails at the token exchange. |
+| ID token claims | `sub` and `email` must both be present in the **ID token** itself. RavenDB Cloud does not call the UserInfo endpoint. |
+| Verified email | At a user's first sign-in, if the ID token marks the email as unverified (`email_verified: false`), the sign-in is refused. A token without the claim is accepted. |
+| Scopes | `openid profile email`. The scopes are fixed; allow them for the application at your identity provider. |
+| Redirect URL | `https://cloud.ravendb.net/api/v1/sso/callback`, registered at your identity provider exactly as shown — no trailing slash or extra characters. |
+| SCIM (optional) | For *Sign-in and user provisioning (SCIM)*: an identity provider that pushes users and groups to a SCIM 2.0 endpoint with a bearer token, such as Okta or Microsoft Entra ID (P1 or P2). |
+
+
+A `groups` claim in the ID token is ignored. Roles come only from SCIM group membership and your
+[group to role mapping](../cloud/cloud-sso.mdx#group-to-role-mapping).
+
+
+## Connect your identity provider
+
+Before you start, create an OpenID Connect application at your identity provider - see
+[Provider setup guides](../cloud/cloud-sso.mdx#provider-setup-guides). You need its **issuer**,
+**client ID** and **client secret**.
+
+1. In the Portal sidebar, open **Account features** and click **Configure** on the
+ **External SSO & User Management** card.
+2. **Management type** — choose **Sign-in only** or **Sign-in and user provisioning (SCIM)**.
+ See [Management types](../cloud/cloud-sso.mdx#management-types).
+3. **Identity provider** — enter your OpenID Connect details:
+ * **Issuer / discovery URL** — the issuer of your identity provider, e.g. `https://idp.example.com`.
+ * **Client ID** and **Client secret** — from the application you created.
+ * **Scopes** — shown for reference: `openid profile email`.
+4. **Redirect URL** — copy the URL shown and add it to the application's redirect (callback) URLs at
+ your identity provider. It must match exactly.
+5. **Review** — check the details and click **Create connection**.
+
+
+
+The connection is created and the SSO settings page opens. A **Finish setting up SSO** banner lists the
+remaining steps.
+
+
+With **Sign-in and user provisioning (SCIM)**, creating the connection also creates the first SCIM token
+and shows it together with the **SCIM base URL**. The token is displayed only once — copy both values
+and enter them in your identity provider's provisioning settings.
+See [SCIM provisioning](../cloud/cloud-sso.mdx#scim-provisioning).
+
+
+## Provider setup guides
+
+Every provider needs the same three things: an OpenID Connect **web application** that uses the
+authorization code flow, the [Redirect URL](../cloud/cloud-sso.mdx#identity-provider-requirements) registered
+on it, and its **issuer**, **client ID** and **client secret** entered in the
+[connect wizard](../cloud/cloud-sso.mdx#connect-your-identity-provider). Assign the application to the people who
+should sign in.
+
+### Okta
+
+* Create an app integration of type **OIDC - OpenID Connect**, application type **Web Application**.
+* Add the Redirect URL as a **Sign-in redirect URI**, and use **Client secret** for client authentication.
+* Issuer: your Okta domain, e.g. `https://your-company.okta.com`. If you use a custom authorization
+ server, use its issuer instead, e.g. `https://your-company.okta.com/oauth2/default`.
+* For *Sign-in and user provisioning (SCIM)*, configure SCIM provisioning with:
+ * **SCIM connector base URL** — the SCIM base URL from the Portal.
+ * **Unique identifier field for users** — `userName`.
+ * **Authentication Mode** — **HTTP Header**, with the SCIM token as the bearer token.
+ * Enable creating, updating and deactivating users, and push the groups you want to
+ [map to roles](../cloud/cloud-sso.mdx#group-to-role-mapping).
+ * Set the application's **Application username format** to **Email**, so that the SCIM `userName`
+ is the user's email address. See [SCIM provisioning](../cloud/cloud-sso.mdx#scim-provisioning).
+
+### Microsoft Entra ID
+
+* Register an application (**App registrations** > **New registration**) and add the Redirect URL with
+ the **Web** platform.
+* Create a client secret under **Certificates & secrets**, and copy its **value**.
+* Under **Token configuration**, add the optional **email** claim to the **ID** token, so that the ID
+ token carries the user's email address.
+* Issuer: `https://login.microsoftonline.com//v2.0`. The client ID is the
+ **Application (client) ID**.
+* For *Sign-in and user provisioning (SCIM)* (requires Microsoft Entra ID P1 or P2): in the application's
+ **Enterprise application** > **Provisioning**, set **Provisioning Mode** to **Automatic**, enter the
+ SCIM base URL as **Tenant URL** and the SCIM token as **Secret Token**, and test the connection.
+ Entra ID maps `userPrincipalName` to the SCIM `userName` by default. If your users' principal names
+ differ from their email addresses, map `mail` to `userName` under **Attribute mappings**.
+
+Microsoft Entra ID does not send an `email_verified` claim; RavenDB Cloud accepts its tokens without it.
+
+### Google
+
+* In the Google Cloud console, create an **OAuth client ID** of type **Web application**, and add the
+ Redirect URL to its **Authorized redirect URIs**.
+* Issuer: `https://accounts.google.com`.
+* To limit sign-in to your Google Workspace organization, set the OAuth consent screen's user type to
+ **Internal**.
+* Google Workspace does not provision users to custom SCIM applications, so use **Sign-in only** and add
+ your team on the Users & Access page.
+
+### Other OpenID Connect providers
+
+Auth0, Keycloak, Ping Identity, OneLogin and other providers work the same way: create a regular web
+application (confidential client) with the authorization code flow, allow the `client_secret_post`
+client authentication method, register the Redirect URL, and enter the issuer exactly as the provider's
+discovery document states it (for Keycloak: `https:///realms/`).
+
+Use **Sign-in only** with providers that cannot push users to an external SCIM endpoint, such as Auth0.
+
+## SCIM provisioning
+
+With **Sign-in and user provisioning (SCIM)**, your identity provider pushes users and groups to
+RavenDB Cloud:
+
+* Assigning a user to the application creates an SSO user in your account, with the SCIM `userName`
+ as the user's email address.
+* A full update of the user (SCIM `PUT`, which Okta sends) is applied to that SSO user. A partial update
+ (SCIM `PATCH`) can only activate or deactivate the user; any other change is rejected.
+* Deactivating or unassigning the user removes them from the account.
+* Group memberships drive the user's roles through the [group to role mapping](../cloud/cloud-sso.mdx#group-to-role-mapping).
+
+SCIM never changes the **account owner**.
+
+
+RavenDB Cloud reads the SSO user's email address from the SCIM `userName` and ignores the `emails`
+attribute. At the user's first sign-in, the `email` claim in the ID token must match that address;
+otherwise the sign-in fails with *You don't have access to this account yet.* Configure your identity
+provider to send the user's email address as the `userName`.
+
+
+Configure your identity provider with:
+
+| **Setting** | **Value** |
+|-------------|-----------|
+| SCIM base URL | The **SCIM base URL** shown on the SSO settings page. Enter it as shown — your identity provider appends `/Users` and `/Groups` itself. |
+| Authentication | HTTP header bearer token: the **SCIM token** issued in the Portal. An API key does not work here. |
+
+
+
+**SCIM tokens**
+
+* The connect wizard creates the first token. To create another one, click **Generate SCIM token** on the
+ **SCIM provisioning** card of the SSO settings page.
+* A token is shown only once, when it is created. Save it somewhere safe.
+* Tokens do not expire. Revoke a token you no longer use.
+* You can have several active tokens, for example to rotate them without downtime.
+* Managing tokens requires the **External SSO & User Management** role.
+
+SCIM requests are accepted only while the connection uses **Sign-in and user provisioning (SCIM)**.
+
+## Group to role mapping
+
+In **Sign-in and user provisioning (SCIM)** mode, the groups your identity provider pushes appear under
+**Discovered groups** on the SSO settings page. Edit a group's mapping to set:
+
+* **Defined roles** — the [account roles](../cloud/cloud-account.mdx#account-roles) that members of the group receive.
+* **Group access** — the members' [product permissions](../cloud/cloud-account.mdx#product-permissions), including
+ the default access for new products.
+
+How the mapping is applied:
+
+* A user who belongs to several groups receives the roles and product permissions of all of them combined.
+* A change to the mapping applies to the group's members immediately.
+* Any account role can be mapped. A member who is not the account owner can map only roles and product
+ permissions they hold themselves.
+* In this mode, SSO users are locked on the Users & Access page and in a product's
+ [User Access](../cloud/portal/cloud-portal-products-tab.mdx#user-access) widget: their roles and product
+ permissions change only through the mapping.
+
+
+Anyone who can change group membership in your identity provider can, through the mapping, grant the
+roles mapped to that group — including **Account with User Management** and
+**External SSO & User Management**. Map those roles only to groups whose membership you control.
+
+
+## Signing in with SSO
+
+SSO users sign in from the RavenDB Cloud [login page](https://cloud.ravendb.net/user/login):
+
+1. Click **Sign in with External SSO**.
+2. Enter your **Account domain** and click **Continue with SSO**.
+3. Sign in at your identity provider. You are then returned to the Portal.
+
+
+
+Your identity provider asks for your credentials at every sign-in, even if you are already signed in
+there.
+
+The SSO settings page shows a **Sign-in link for your team** that skips step 2:
+`https://cloud.ravendb.net/user/login/enterprise?domain=`.
+Adding an SSO user sends no email, so share this link with your team. If you add RavenDB Cloud to your
+identity provider's app dashboard, point the tile at this link — the sign-in must start at RavenDB Cloud.
+
+* A person must already exist as an SSO user — added on the Users & Access page, or provisioned through
+ SCIM. Signing in never creates users.
+* The sign-in must be completed in the browser that started it, within 10 minutes.
+* If your account restricts member email domains, an SSO user with an email address outside them is
+ refused at their first sign-in.
+
+
+The account owner never signs in through SSO and is never provisioned, deprovisioned or changed by
+SCIM. The owner keeps using their own login, so a misconfigured connection cannot lock you out of the
+account. If the owner tries to sign in through SSO, the sign-in ends with
+*You don't have access to this account yet.*
+
+
+
+Multi-factor authentication for SSO users is enforced by your identity provider. SSO users cannot turn
+on RavenDB Cloud two-factor authentication; their Profile **Security** page shows
+*Managed by your identity provider* instead. See [MFA](../cloud/cloud-security.mdx#mfa).
+
+
+**When SSO sign-in cannot complete**
+
+| Message | What it means |
+|---|---|
+| You don't have access to this account yet. Contact your administrator. | No SSO user exists for you on the connection. Ask an administrator to add or provision you. |
+| Your account does not have access to sign in through single sign-on. Contact your administrator. | You are not an active member of the account, or your email domain is not allowed. |
+| Single sign-on is not enabled for this account. | SSO is disabled, or the feature is not active for the account. |
+| Your single sign-on session expired. Please try again. | The sign-in took longer than 10 minutes, or finished in a different browser. Start again. |
+| Single sign-on failed. Please try again or contact your administrator. | The identity provider returned an error, the sign-in was cancelled, or the ID token failed validation. |
+| Your identity provider reports that your email address is not verified, so it cannot be used to sign in. Ask your administrator to verify it. | The ID token marks the email as unverified. Verify it at the identity provider. |
+| Single sign-on is misconfigured for this account. Please contact support. | The stored connection cannot be read. Contact [Support](../cloud/cloud-support.mdx). |
+
+## Managing the connection
+
+Open **Account features** and click **Manage** on the **External SSO & User Management** card.
+The SSO settings page shows the **Redirect URL** and the **Management type**. Holders of the
+**External SSO & User Management** role also get an actions menu with:
+
+* **Edit** — change the issuer, client ID or client secret. Leave the client secret empty to keep the
+ stored one.
+* **Change management type** — see [Management types](../cloud/cloud-sso.mdx#management-types).
+* **Reset identity links** — clears the stored link between each SSO user and their identity at the
+ provider. Each user is linked again at their next sign-in. Use it when users cannot sign in after the
+ application was re-created at your identity provider.
+* **Disable SSO** — stops sign-in through your identity provider.
+
+
+
+
+Disabling SSO also **deletes every SSO user**, every discovered group, the group mapping and all SCIM
+tokens. Enabling SSO again starts from an empty setup.
+
+
+
+Changing the **issuer** or **client ID** resets the identity links automatically, because the identity
+provider may issue new user identifiers for the new application.
+
+
+If the feature is deactivated for your account, SSO sign-in and SCIM requests stop, and the
+configuration is kept.
+
+## Troubleshooting
+
+* **Sign-in fails although the identity provider shows a successful login** — check that the `email`
+ claim is in the **ID token**, not only in the UserInfo response. This is the most common setup issue.
+* **Sign-in fails right after the identity provider redirects back** — check that the provider accepts
+ `client_secret_post` client authentication, and that the Redirect URL is registered exactly as shown.
+* **SCIM requests return 404** — check the SCIM base URL: use it exactly as shown in the Portal, without
+ adding `/scim/v2` or `/Users` to it.
+* **SCIM requests return 401** — the SCIM token is wrong or no longer exists. Revoking a token, leaving
+ *Sign-in and user provisioning (SCIM)* mode and **Disable SSO** all delete tokens; generate a new one
+ and enter it at your identity provider.
+* **SCIM requests return 403 with "SSO is not approved for this account."** — the feature is not
+ active for your account. Contact [Support](../cloud/cloud-support.mdx).
+* **A provisioned user gets *You don't have access to this account yet.*** — the SCIM `userName` does
+ not match the `email` claim in the ID token. See [SCIM provisioning](../cloud/cloud-sso.mdx#scim-provisioning).
+* **The identity provider's connection test fails right after you create a token** — wait a few seconds
+ and test again.
+* **Everyone is locked out after the application was re-created at the identity provider** — use
+ **Reset identity links**.
diff --git a/cloud/portal/assets/portal-account-features-sso-card.png b/cloud/portal/assets/portal-account-features-sso-card.png
new file mode 100644
index 0000000000..94c1b20f33
Binary files /dev/null and b/cloud/portal/assets/portal-account-features-sso-card.png differ
diff --git a/cloud/portal/assets/portal-account-overview.png b/cloud/portal/assets/portal-account-overview.png
index e2e2c9afc0..ff5230383b 100644
Binary files a/cloud/portal/assets/portal-account-overview.png and b/cloud/portal/assets/portal-account-overview.png differ
diff --git a/cloud/portal/assets/portal-billing-costs-account-benefits.png b/cloud/portal/assets/portal-billing-costs-account-benefits.png
index 6a190d50d5..5ae9582250 100644
Binary files a/cloud/portal/assets/portal-billing-costs-account-benefits.png and b/cloud/portal/assets/portal-billing-costs-account-benefits.png differ
diff --git a/cloud/portal/assets/portal-billing-costs-billing-history.png b/cloud/portal/assets/portal-billing-costs-billing-history.png
index 4baf8375ec..e01ed9ad46 100644
Binary files a/cloud/portal/assets/portal-billing-costs-billing-history.png and b/cloud/portal/assets/portal-billing-costs-billing-history.png differ
diff --git a/cloud/portal/assets/portal-billing-costs-current-billing-period.png b/cloud/portal/assets/portal-billing-costs-current-billing-period.png
index c19c975639..a450f071c4 100644
Binary files a/cloud/portal/assets/portal-billing-costs-current-billing-period.png and b/cloud/portal/assets/portal-billing-costs-current-billing-period.png differ
diff --git a/cloud/portal/assets/portal-billing-costs-current-period-costs.png b/cloud/portal/assets/portal-billing-costs-current-period-costs.png
index f3ac3a16e4..da690ba8b3 100644
Binary files a/cloud/portal/assets/portal-billing-costs-current-period-costs.png and b/cloud/portal/assets/portal-billing-costs-current-period-costs.png differ
diff --git a/cloud/portal/assets/portal-billing-costs-pay-now-modal.png b/cloud/portal/assets/portal-billing-costs-pay-now-modal.png
index 57e69c79fe..4eb9f910d4 100644
Binary files a/cloud/portal/assets/portal-billing-costs-pay-now-modal.png and b/cloud/portal/assets/portal-billing-costs-pay-now-modal.png differ
diff --git a/cloud/portal/assets/portal-billing-costs-spending.png b/cloud/portal/assets/portal-billing-costs-spending.png
index 4dca4b687e..cdd89fdb4a 100644
Binary files a/cloud/portal/assets/portal-billing-costs-spending.png and b/cloud/portal/assets/portal-billing-costs-spending.png differ
diff --git a/cloud/portal/assets/portal-home-overview.png b/cloud/portal/assets/portal-home-overview.png
index f68f30f54d..15fe8a16e0 100644
Binary files a/cloud/portal/assets/portal-home-overview.png and b/cloud/portal/assets/portal-home-overview.png differ
diff --git a/cloud/portal/assets/portal-product-create-customize-section.png b/cloud/portal/assets/portal-product-create-customize-section.png
index b077e5d698..ba61b4af00 100644
Binary files a/cloud/portal/assets/portal-product-create-customize-section.png and b/cloud/portal/assets/portal-product-create-customize-section.png differ
diff --git a/cloud/portal/assets/portal-product-details-cluster-health.png b/cloud/portal/assets/portal-product-details-cluster-health.png
index 782c9cf042..cd309fa670 100644
Binary files a/cloud/portal/assets/portal-product-details-cluster-health.png and b/cloud/portal/assets/portal-product-details-cluster-health.png differ
diff --git a/cloud/portal/assets/portal-product-details-edit-tier.png b/cloud/portal/assets/portal-product-details-edit-tier.png
index dd3efc98ae..e12dd60214 100644
Binary files a/cloud/portal/assets/portal-product-details-edit-tier.png and b/cloud/portal/assets/portal-product-details-edit-tier.png differ
diff --git a/cloud/portal/assets/portal-product-details-serverless.png b/cloud/portal/assets/portal-product-details-serverless.png
index a289654641..c50b085616 100644
Binary files a/cloud/portal/assets/portal-product-details-serverless.png and b/cloud/portal/assets/portal-product-details-serverless.png differ
diff --git a/cloud/portal/assets/portal-product-details-user-access.png b/cloud/portal/assets/portal-product-details-user-access.png
index be29e6874d..43485047c3 100644
Binary files a/cloud/portal/assets/portal-product-details-user-access.png and b/cloud/portal/assets/portal-product-details-user-access.png differ
diff --git a/cloud/portal/assets/portal-product-nodes-additional-nodes.png b/cloud/portal/assets/portal-product-nodes-additional-nodes.png
index 887384ce2f..efbe7cfab0 100644
Binary files a/cloud/portal/assets/portal-product-nodes-additional-nodes.png and b/cloud/portal/assets/portal-product-nodes-additional-nodes.png differ
diff --git a/cloud/portal/assets/portal-profile-invitations.png b/cloud/portal/assets/portal-profile-invitations.png
new file mode 100644
index 0000000000..49e0874c7e
Binary files /dev/null and b/cloud/portal/assets/portal-profile-invitations.png differ
diff --git a/cloud/portal/assets/portal-sidebar.png b/cloud/portal/assets/portal-sidebar.png
index 6de1586bec..6c8a073d6b 100644
Binary files a/cloud/portal/assets/portal-sidebar.png and b/cloud/portal/assets/portal-sidebar.png differ
diff --git a/cloud/portal/assets/portal-sso-connect-wizard-identity-provider.png b/cloud/portal/assets/portal-sso-connect-wizard-identity-provider.png
new file mode 100644
index 0000000000..f4c9cf6dcb
Binary files /dev/null and b/cloud/portal/assets/portal-sso-connect-wizard-identity-provider.png differ
diff --git a/cloud/portal/assets/portal-sso-settings-scim.png b/cloud/portal/assets/portal-sso-settings-scim.png
new file mode 100644
index 0000000000..a7d43ab8a5
Binary files /dev/null and b/cloud/portal/assets/portal-sso-settings-scim.png differ
diff --git a/cloud/portal/assets/portal-sso-settings-sign-in-only.png b/cloud/portal/assets/portal-sso-settings-sign-in-only.png
new file mode 100644
index 0000000000..a47cf14303
Binary files /dev/null and b/cloud/portal/assets/portal-sso-settings-sign-in-only.png differ
diff --git a/cloud/portal/assets/portal-support-request-cloud-support-on-free-support.png b/cloud/portal/assets/portal-support-request-cloud-support-on-free-support.png
index 7c4bfba67f..7c6281b48d 100644
Binary files a/cloud/portal/assets/portal-support-request-cloud-support-on-free-support.png and b/cloud/portal/assets/portal-support-request-cloud-support-on-free-support.png differ
diff --git a/cloud/portal/assets/portal-users-and-access-add-sso-user.png b/cloud/portal/assets/portal-users-and-access-add-sso-user.png
new file mode 100644
index 0000000000..894fc78009
Binary files /dev/null and b/cloud/portal/assets/portal-users-and-access-add-sso-user.png differ
diff --git a/cloud/portal/assets/portal-users-and-access-edit-user-product-permissions.png b/cloud/portal/assets/portal-users-and-access-edit-user-product-permissions.png
index e79f99bf3e..609455c8d1 100644
Binary files a/cloud/portal/assets/portal-users-and-access-edit-user-product-permissions.png and b/cloud/portal/assets/portal-users-and-access-edit-user-product-permissions.png differ
diff --git a/cloud/portal/assets/portal-users-and-access-invite-user-wizard-product-permissions.png b/cloud/portal/assets/portal-users-and-access-invite-user-wizard-product-permissions.png
index 587749044e..77c4e060b3 100644
Binary files a/cloud/portal/assets/portal-users-and-access-invite-user-wizard-product-permissions.png and b/cloud/portal/assets/portal-users-and-access-invite-user-wizard-product-permissions.png differ
diff --git a/cloud/portal/assets/portal-users-and-access-sso-users-scim.png b/cloud/portal/assets/portal-users-and-access-sso-users-scim.png
new file mode 100644
index 0000000000..28abeade45
Binary files /dev/null and b/cloud/portal/assets/portal-users-and-access-sso-users-scim.png differ
diff --git a/cloud/portal/assets/portal-users-and-access-sso-users.png b/cloud/portal/assets/portal-users-and-access-sso-users.png
new file mode 100644
index 0000000000..d76e952986
Binary files /dev/null and b/cloud/portal/assets/portal-users-and-access-sso-users.png differ
diff --git a/cloud/portal/cloud-portal-account-tab.mdx b/cloud/portal/cloud-portal-account-tab.mdx
index d6d5595fd2..b507f29230 100644
--- a/cloud/portal/cloud-portal-account-tab.mdx
+++ b/cloud/portal/cloud-portal-account-tab.mdx
@@ -45,3 +45,9 @@ You can add, remove or change the default credit card.
### User management
Managing account users — inviting or removing members, assigning their [account roles](../../cloud/cloud-account.mdx#account-roles), and managing their [per-product permissions](../../cloud/cloud-account.mdx#product-permissions) — is now done from the dedicated [Users & Access](../../cloud/portal/cloud-portal-users-and-access-tab.mdx) page.
+
+### Account features
+
+Features that apply to the whole account, such as single sign-on through your organization's identity
+provider, are set up from the separate **Account features** view in the sidebar.
+See [External SSO & User Management](../../cloud/cloud-sso.mdx).
diff --git a/cloud/portal/cloud-portal-billing-tab.mdx b/cloud/portal/cloud-portal-billing-tab.mdx
index 9a27b19f50..9685137ba4 100644
--- a/cloud/portal/cloud-portal-billing-tab.mdx
+++ b/cloud/portal/cloud-portal-billing-tab.mdx
@@ -19,7 +19,7 @@ Use your account's Billing & Costs tab to view your present costs, past invoices
* In this page:
* [The Billing & Costs Tab](#the-billing-&-costs-tab)
- * [Pay Now](../../cloud/portal/cloud-portal-billing-tab.mdx#pay-now)
+ * [Retry a failed payment](../../cloud/portal/cloud-portal-billing-tab.mdx#pay-now)
* [Current billing period](../../cloud/portal/cloud-portal-billing-tab.mdx#current-billing-period)
* [Current billing period costs](../../cloud/portal/cloud-portal-billing-tab.mdx#current-billing-period-costs)
* [Account benefits](../../cloud/portal/cloud-portal-billing-tab.mdx#account-benefits)
@@ -32,16 +32,17 @@ Use your account's Billing & Costs tab to view your present costs, past invoices
The Billing & Costs tab will show your existing resources and their costs as well as past billing events.
-### Pay Now
+### Retry a failed payment {#pay-now}
-
+
-
+
- The *Pay Now* button is designed to facilitate immediate payment of outstanding costs accrued from previous billing
- cycles. This feature is especially useful for ensuring timely payments and maintaining up-to-date account status.
- It can be used when automatic charge fails due to reasons like expired cards or insufficient funds.
- You can read more about the _Pay Now_ option on the [Pricing, Payment and Billing](../cloud-pricing-payment-billing.mdx#pay-now) page.
+ When an automatic charge fails, for example because of an expired card or insufficient funds, the Billing & Costs
+ tab shows a *We couldn't process your payment* banner with the date of the oldest unpaid cost and the total due.
+ Click **Retry payment** to pay the outstanding costs from previous billing cycles right away. A *Confirm payment*
+ dialog shows the amount to be charged; click **Confirm and pay** to proceed.
+ You can read more about retrying a payment on the [Pricing, Payment and Billing](../cloud-pricing-payment-billing.mdx#pay-now) page.
### Current billing period
@@ -50,15 +51,15 @@ The Billing & Costs tab will show your existing resources and their costs as wel
The *Current billing period* widget shows information about accrued costs in the current billing period and basic information about the last invoice.
It also shows your **Unbilled** total — the costs accrued so far that have not yet been settled by an invoice — and a
-progress bar marking today's position between the start and end of the period. Use the **Cost Details** button to open
-the [Cost details](../../cloud/portal/cloud-portal-billing-tab.mdx#cost-details) view for the unbilled period.
+progress bar marking today's position between the start and end of the period; hover the marker to see today's date.
### Current billing period costs
The *Current billing period costs* widget breaks the current period's costs down as a donut chart, so you can see at a
-glance what is driving the bill.
+glance what is driving the bill. Use its **Cost Details** button to open the
+[Cost details](../../cloud/portal/cloud-portal-billing-tab.mdx#cost-details) view for the unbilled period.
Use the **Group costs by** selector to switch the breakdown between:
@@ -84,6 +85,7 @@ Depending on the state of the period, the widget may report instead that:
The *Account benefits* widget shows information about current and expired benefits, their scope, validity dates and amounts.
+A one-time credit that has been fully used is listed under **Expired**, even before its end date.
### Billing history
@@ -94,7 +96,10 @@ The *Billing history* widget shows information about issued invoices, their stat
Use the year selector above the table to move between years. Only years for which you have billing history are offered,
and the selector always reflects the year the table is currently showing.
-Selecting a row opens that period's [Cost details](../../cloud/portal/cloud-portal-billing-tab.mdx#cost-details) view.
+Use a row's **Cost Details** button to open that period's
+[Cost details](../../cloud/portal/cloud-portal-billing-tab.mdx#cost-details) view, and **See invoice** to open its
+invoice (**See invoices** when the period has several). Accounts billed through a cloud marketplace have no invoice
+buttons.
### Spending
@@ -139,9 +144,8 @@ account summary, which already includes backup costs, and so **excludes account
The *Cost details* view breaks a single billing period down to the individual products that produced the costs.
Open it with the **Cost Details** button on the
-[Current billing period](../../cloud/portal/cloud-portal-billing-tab.mdx#current-billing-period) or
[Current billing period costs](../../cloud/portal/cloud-portal-billing-tab.mdx#current-billing-period-costs) widget, or
-by selecting a row in [Billing history](../../cloud/portal/cloud-portal-billing-tab.mdx#billing-history).
+with the **Cost Details** button in a [Billing history](../../cloud/portal/cloud-portal-billing-tab.mdx#billing-history) row.
The view is headed with the period it describes and contains:
diff --git a/cloud/portal/cloud-portal-home-tab.mdx b/cloud/portal/cloud-portal-home-tab.mdx
index ed3cbfcc50..b6a2d3ec68 100644
--- a/cloud/portal/cloud-portal-home-tab.mdx
+++ b/cloud/portal/cloud-portal-home-tab.mdx
@@ -26,6 +26,7 @@ Use this tab to manage your account and assigned roles. You can also use it to v
In the **Your profile** section, you can check your 2FA settings and the date of your last login.
+To change your 2FA settings, open **Security** from the [profile menu](../../cloud/portal/cloud-portal.mdx#profile).
In the **Roles and access** section, you can review your access on this account at a glance:
diff --git a/cloud/portal/cloud-portal-products-tab.mdx b/cloud/portal/cloud-portal-products-tab.mdx
index 9345caa9da..2af5bafa14 100644
--- a/cloud/portal/cloud-portal-products-tab.mdx
+++ b/cloud/portal/cloud-portal-products-tab.mdx
@@ -418,5 +418,7 @@ Changing your product deployment type is **irreversible**.
The product view includes a **User Access** widget that lists the account users who have access to this product, together with their access level. If you can manage users, you can change a user's [preset](../cloud-account.mdx#permission-presets) and toggle the **Security admin** add-on directly in the widget, then click **Save changes** — without leaving the product view. The **Account Owner** is always shown with **full access**. Use **Manage in Users & Access** to open the [Users & Access](./cloud-portal-users-and-access-tab.mdx) page for the full user-management view. When no other users have been granted access yet, the widget shows an empty state.
+When [External SSO](../cloud-sso.mdx) is set up, SSO users are listed by their email address and marked with an **SSO** badge. In *Sign-in and user provisioning (SCIM)* mode, their rows are locked: a lock icon explains that the user is managed by your identity provider, and their access changes only through the [group to role mapping](../cloud-sso.mdx#group-to-role-mapping). If saving fails, the Portal shows the reason.
+
diff --git a/cloud/portal/cloud-portal-users-and-access-tab.mdx b/cloud/portal/cloud-portal-users-and-access-tab.mdx
index 167ebbad5f..2ea6d555cd 100644
--- a/cloud/portal/cloud-portal-users-and-access-tab.mdx
+++ b/cloud/portal/cloud-portal-users-and-access-tab.mdx
@@ -22,6 +22,8 @@ The **Users & Access** page lets you manage all users on your account: invite or
* [The users list](../../cloud/portal/cloud-portal-users-and-access-tab.mdx#the-users-list)
* [Who can manage users and permissions](../../cloud/portal/cloud-portal-users-and-access-tab.mdx#who-can-manage-users-and-permissions)
* [Adding a new user](../../cloud/portal/cloud-portal-users-and-access-tab.mdx#adding-a-new-user)
+ * [Adding an SSO user](../../cloud/portal/cloud-portal-users-and-access-tab.mdx#adding-an-sso-user)
+ * [Accepting an invitation](../../cloud/portal/cloud-portal-users-and-access-tab.mdx#accepting-an-invitation)
* [Removing a user](../../cloud/portal/cloud-portal-users-and-access-tab.mdx#removing-a-user)
* [Managing existing users](../../cloud/portal/cloud-portal-users-and-access-tab.mdx#managing-existing-users)
@@ -30,6 +32,10 @@ The **Users & Access** page lets you manage all users on your account: invite or
The Users & Access page lists every user on the account. Each row shows the user's **email**, their **status** (*Owner*, *Active*, or a pending invitation), and their **access** — split into their assigned [account roles](../../cloud/cloud-account.mdx#account-roles) and their per-product access.
+When [External SSO](../../cloud/cloud-sso.mdx) is active, the list is split into two tables: **Cloud users**, who sign in with a magic link or with Google, GitHub or Microsoft, and **SSO users**, who sign in through your identity provider.
+
+
+
Access is shown as two compact chips you can expand — for example *3 roles* and *3 products*. Expanding the product-access chip lists each product the user can access together with its level: the resolved [permission preset](../../cloud/cloud-account.mdx#permission-presets) (*Viewer*, *Operator*, *Manager*, or *Admin*), a **Security admin** badge where that add-on is enabled, or **Custom** for a legacy permission set that does not match any preset. The **Account Owner** is shown with full access to all products. Your own row is displayed the same way.
@@ -48,6 +54,7 @@ A user with the **Account with User Management** role can modify the roles of ot
Only the **Account Owner** can modify the roles of users who have the **Account with User Management** role, or assign/remove that specific role. The **Account Owner** can modify any role for any user.
+The exception is [External SSO](../../cloud/cloud-sso.mdx#group-to-role-mapping) with SCIM provisioning: a member who holds **Account with User Management** can map that role to an identity provider group, and the group's members receive it.
Per-product permissions follow the same principle: in the edit-user panel, product controls are **locked with a padlock** for products the acting manager cannot access. See [Product permissions](../../cloud/cloud-account.mdx#who-can-manage-product-permissions) for the full rules.
@@ -57,12 +64,45 @@ You can read more about *account roles* and *product permissions* on the [Accoun
Click **Invite new user** at the top of the users list to open the invite panel. Both account roles and per-product permissions are set in this single panel.
+
+When [External SSO](../../cloud/cloud-sso.mdx) is active in *Sign-in only* mode, the button reads **Add new SSO user**. To invite a Cloud user, open its dropdown and select **Invite new Cloud user**.
+
+
**1**. Provide an *email address*.
**2**. Select the user's [account roles](../../cloud/cloud-account.mdx#account-roles).
- **3**. Assign *per-product permissions* using the [presets](../../cloud/cloud-account.mdx#permission-presets), and optionally set the user's [**Default access for new products**](../../cloud/cloud-account.mdx#default-access-for-new-products).
- **4**. Click **Invite user** to send the invitation.
+ **3**. Under **Product permissions**, set the user's access to each product listed in **Existing products**, by choosing a [preset](../../cloud/cloud-account.mdx#permission-presets) from the product's access-level menu. The **Security admin** add-on is a switch at the bottom of the same menu. Use **Search products** to find a product, and **Set all to** to apply one level to all listed products.
+ **4**. If you are the **Account Owner**, optionally set the user's [default access for new products](../../cloud/cloud-account.mdx#default-access-for-new-products) under **New products**.
+ **5**. Click **Invite user** to send the invitation.
+
+## Adding an SSO user
+
+When [External SSO](../../cloud/cloud-sso.mdx) is active in **Sign-in only** mode, you add the people who sign in through your identity provider as SSO users:
+
+
+
+ **1**. Click **Add new SSO user**.
+ **2**. Enter the user's *email address* — the address your identity provider reports for them.
+ **3**. Select the user's [account roles](../../cloud/cloud-account.mdx#account-roles). If you are the **Account Owner**, you can also set their access to **New products**.
+ **4**. Click **Add user**.
+
+Adding an SSO user sends no email. Share the **Sign-in link for your team** from the SSO settings page with them — see [Signing in with SSO](../../cloud/cloud-sso.mdx#signing-in-with-sso). To give an SSO user access to existing products, [edit](#managing-existing-users) the user after adding them.
+
+In **Sign-in and user provisioning (SCIM)** mode, your identity provider creates the SSO users, so they are not added here.
+Their edit and remove actions are disabled: roles and product permissions come from the
+[group to role mapping](../../cloud/cloud-sso.mdx#group-to-role-mapping). **Manage in SSO settings** opens the SSO settings page.
+
+
+
+## Accepting an invitation
+
+An invited user receives an email with an invitation link.
+
+* **From the email** — click the link, then **Sign in & accept the invitation**. If you do not have a RavenDB Cloud login for that email address yet, you are taken to registration first. If the link has expired, is invalid, or has already been used, the page says so — ask the account administrator for a new invitation.
+* **From the Portal** — open the profile menu at the bottom of the sidebar and select **Invitations**. Click **Accept** on the pending invitation. The Portal confirms with *Joined …*, and the account appears under **Organizations**. If accepting fails, you see *Couldn't accept the invitation — try again.*
+
+
## Removing a user
@@ -82,9 +122,13 @@ Click the **Edit** button on a user's row to open the edit panel. As with the in
**1**. Adjust the user's [account roles](../../cloud/cloud-account.mdx#account-roles).
- **2**. Adjust *per-product permissions* using the presets. Each preset shows a short description of what it grants. Products you cannot access yourself are **locked** (see the [subset rule](#who-can-manage-users-and-permissions) above). If you are the **Account Owner**, you can also update the user's **Default access for new products** here.
+ **2**. Adjust *per-product permissions* under **Existing products**, using each product's access-level menu. Each preset shows a short description of what it grants. Products you cannot access yourself are **locked** (see the [subset rule](#who-can-manage-users-and-permissions) above). If you are the **Account Owner**, you can also update the user's default access under **New products**.
**3**. Click **Save changes**.
+
+In **Sign-in and user provisioning (SCIM)** mode, SSO users cannot be edited or removed here: their **Edit** and **Remove** buttons are disabled. Their roles and product permissions come from the [group to role mapping](../../cloud/cloud-sso.mdx#group-to-role-mapping), and they are removed by deactivating them at your identity provider.
+
+
Opening a product you have no access to shows a clear message — asking you to have your account administrator grant access via **Users & Access** — rather than a bare error. Ask an account administrator (the Account Owner or a user with the **Account with User Management** role) to grant you the appropriate [product permissions](../../cloud/cloud-account.mdx#product-permissions).
diff --git a/cloud/portal/cloud-portal.mdx b/cloud/portal/cloud-portal.mdx
index c182828136..380f712af4 100644
--- a/cloud/portal/cloud-portal.mdx
+++ b/cloud/portal/cloud-portal.mdx
@@ -29,8 +29,9 @@ takes you to your account's Portal, which gives you access to all the different
-You navigate the Portal from the **sidebar** on the left. It can be collapsed to icons only, using the control next to
-the logo, to give the current view more room.
+You navigate the Portal from the **sidebar** on the left. To give the current view more room, collapse it to icons
+only with the **Collapse sidebar** control next to the logo. While it is collapsed, hover an icon to see its label, and
+click the logo mark to expand the sidebar again.
At the top of the sidebar, the **account switcher** lets you move between the cloud accounts you have access to. Each
account is identified by its **domain name**. See
@@ -66,10 +67,15 @@ account is identified by its **domain name**. See
* **[Account](../../cloud/portal/cloud-portal-account-tab.mdx)**
View and edit your invoices and credit card information.
+* **Account features**
+ Set up features that apply to the whole account, such as
+ [External SSO & User Management](../../cloud/cloud-sso.mdx).
+
Which views you see depends on your access — for example, *Billing & costs* requires the **Billing**
[account role](../../cloud/cloud-account.mdx#account-roles), and *Users & Access* requires
-**Account with User Management**. Views you have no role for are not shown.
+**Account with User Management**. *Account features* requires **External SSO & User Management** or
+**Account with User Management**, so account owners always see it. Views you have no role for are not shown.
**Products** is gated differently: it appears if you hold the **Products Creation**
[account role](../../cloud/cloud-account.mdx#account-roles), or if you have
@@ -92,8 +98,17 @@ The **Help center** entry at the bottom of the sidebar opens a menu with:
### Profile
-The **profile** entry, also at the bottom of the sidebar, shows your user name and gives you access to your profile
-settings — including [Multi-Factor Authentication](../../cloud/cloud-security.mdx#mfa) — and to **Log out**.
+The **profile** entry, also at the bottom of the sidebar, shows your user name and opens a menu with:
+
+* **Organizations** — the cloud accounts your profile belongs to.
+* **Invitations** — pending invitations to join other cloud accounts. See
+ [Accepting an invitation](../../cloud/portal/cloud-portal-users-and-access-tab.mdx#accepting-an-invitation).
+* **Security** — [Multi-Factor Authentication](../../cloud/cloud-security.mdx#mfa), recovery codes and your
+ recovery phone number.
+* **Cookie settings** — review or change your cookie consent.
+* **Logout**.
+
+On small screens, the same entries are in the menu at the top of the page.
diff --git a/sidebarsCloud.js b/sidebarsCloud.js
index c2995f7f99..7428418985 100644
--- a/sidebarsCloud.js
+++ b/sidebarsCloud.js
@@ -76,6 +76,11 @@ export default {
id: "cloud-account",
label: "Account",
},
+ {
+ type: "doc",
+ id: "cloud-sso",
+ label: "External SSO",
+ },
{
type: "doc",
id: "cloud-maintenance-troubleshooting",