# Fine-Grained Admin Permissions for Organizations

DevFeed: [Fine-Grained Admin Permissions for Organizations](<https://devfeed.tech/articles/fine-grained-admin-permissions-for-organizations-31776.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2026/05/org-fgap>)

Author: Vlasta Ramik

Published: 2026-05-07T00:00:00Z

Content type: release

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [idm](<https://devfeed.tech/tags/idm.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [permissions](<https://devfeed.tech/tags/permissions.md>), [policies](<https://devfeed.tech/tags/policies.md>), [rest-api](<https://devfeed.tech/tags/rest-api.md>), [saml](<https://devfeed.tech/tags/saml.md>), [security](<https://devfeed.tech/tags/security.md>), [sso](<https://devfeed.tech/tags/sso.md>)

## AI overview

Keycloak 26.7.0 adds Fine-Grained Admin Permissions support for Organizations, allowing administrators to assign organization-level manage or view access instead of requiring realm-wide administrative control.

## Source excerpt

In Keycloak 26.7.0, Fine-Grained Admin Permissions (FGAP) will support Organizations as a resource type. This means you can grant an administrator permission to manage Org A while only allowing them to view Org B -- or restrict their access to a single organization entirely. No more realm-wide all-or-nothing admin access for organizations. The Problem Before this release, administering organizations required the manage-realm role, which grants far broader access than just organizations -- it covers realm settings, authentication flows, and much more. There was no way to grant someone access to manage organizations without also giving them control over the entire realm. In multi-tenant deployments where different teams or partners own different organizations, this was a significant security and operational concern. What's New Two changes in Keycloak 26.7.0 work together to solve this: Organization-Specific Admin Roles Organizations will support scoped admin roles that let you delegate day-to-day management tasks without granting realm-wide access. An organization administrator can: Create, update, and delete organizations Invite new members and revoke membership Link and unlink identity providers Manage organization groups These roles grant access to all organizations in the realm and can only be assigned by realm administrators, ensuring that privilege escalation stays under control. Organizations as a FGAP Resource Type Organizations will be a first-class resource type in the Fine-Grained Admin Permissions system, alongside Users, Groups, or Clients. This brings two permission scopes for organizations: manage -- full administrative control over the organization view -- read-only access to the organization and its configuration When FGAP is enabled, permissions can be set per organization. An administrator who is granted manage and view on Org A and view on Org B will see both organizations, but would be able to update (or make other managerial tasks) just Org A in the