# Manage Customer Access

:::important Alpha Feature
Features described on this page are in alpha and subject to change. Some capabilities might require additional access.
:::

This topic describes how to control which customers can access the new Enterprise Portal and how to manage their portal users from the Vendor Portal.

## Enabling Enterprise Portal for customers

For vendors using both Classic and New Enterprise Portal (mixed mode), customer access is controlled per-customer:

- On the customer's **Enterprise Portal access** tab, toggle **Enable Enterprise Portal for this customer** to grant access
- Team admins can use the **Portal Version** toggle to choose whether the customer sees Classic or New
- Customers on the New portal access it at `{appSlug}.enterpriseportal.app` (or your custom domain)

For vendors on the New Enterprise Portal only, all customers can access the portal. You do not need an app-level or per-customer enable toggle.

## Inviting users

To invite a customer's end user to the portal:

1. Go to **Customers > [Customer Name] > Enterprise Portal access**
1. In the **Customer Users** section, click **+ Invite user**
1. Enter the user's email address and click **Send invite**
1. The user receives an email with an invitation link to activate their account

You can also enable **Automatically invite customer email to Enterprise Portal on creation** so that every new customer with an email address receives an invite automatically.

For teams using only the New Enterprise Portal, go to **Enterprise Portal > Customer Access**. In the **Customer invitations** section, enable automatic invitations. In mixed mode, automatic invitations require the app-level **Enable Enterprise Portal for all customers** setting.

For vendors in mixed mode (both Classic and New enabled), the customer creation screen includes a **Use new Enterprise Portal for this customer** checkbox. When checked, the customer is enrolled in the New portal and any auto-invite email points them to the New portal URL instead of Classic. This checkbox is only visible to team admins. When unchecked or not visible, new customers default to Classic.

## Access to multiple channels

A license is assigned to a single channel. To give one end user access to releases from more than one channel (for example, a stable channel for production and an alpha channel for a test environment), create a separate customer for each channel, each with a license on the intended channel.

To present these as a single login, invite the **same email address** to each customer. The user logs in once and switches between the customers using the team switcher in the portal. For the customer-side experience, see [Access with multiple teams](/vendor/enterprise-portal-v2-use#access-with-multiple-teams).

Because each customer appears to the end user as a separate team, name your customers descriptively (for example, `Customer A - Stable` and `Customer A - Alpha`) so users can tell their environments apart.

:::note
Inviting different email addresses to each customer creates separate logins with no team switcher. Use the same email address for each customer to give one person a unified experience.
:::

## Removing users

To remove a user from a customer's portal team:

1. Go to **Customers > [Customer Name] > Enterprise Portal access**
1. In the **Customer Users** table, click the menu icon (**...**) next to the user
1. Select **Remove user**

## Domain restrictions

Restrict which email domains can be invited to a customer's portal:

1. Go to **Customers > [Customer Name] > Enterprise Portal access**
1. In the **Authentication** section, enable **Domain Restrictions**
1. Add one or more allowed email domains (e.g., `acme.com`)

Only users with email addresses matching an allowed domain can be invited. This prevents accidental invitations to personal email addresses or unauthorized domains.

## SAML authentication (Alpha)

Allow customers to use their corporate identity provider for portal login:

1. Go to **Customers > [Customer Name] > Enterprise Portal access**
1. In the **Authentication** section, enable **SAML Authentication**
1. The customer can then configure their IdP details (metadata URL, certificates) from within the Enterprise Portal's team settings

SAML supports just-in-time user provisioning. When a user logs in via SAML for the first time and their email matches a pending invitation, their account is automatically activated.

## Service accounts

Service accounts provide programmatic access to the Enterprise Portal (e.g., for CI/CD pipelines pulling install commands or registry credentials).

- View and manage service accounts on the customer's **Enterprise Portal access** tab under **Customer Service Accounts**
- Service accounts are created by customer team admins from **Team Settings > Service Accounts** in the Enterprise Portal, automatically when a customer starts a new installation from the portal, and when you create install options through the Vendor API
- Vendors can revoke service accounts from the Vendor Portal
- Customer team admins can rotate a service account token in place from the Enterprise Portal, which issues a new token and keeps the same account. Use rotation instead of revoking when a token should be replaced but the account should keep working. See [Rotate or revoke a service account token](/vendor/enterprise-portal-v2-use#rotate-or-revoke-a-service-account-token).

## Emails

For information about configuring a custom email sender, customizing email templates, sending release notifications, and viewing email delivery history, see [Customize Customer Emails](/vendor/enterprise-portal-v2-emails).