# Authorized Organizations (Pairing)

**Navigation:** Admin → People & Permissions → Authorized Organizations

---

## What Are Authorized Organizations?

Authorized Organizations (also called **Pairing**) allows users from one Genesys Cloud org to log into and administer a second org — without needing a separate license seat in the target org.

Common use cases:
- A support vendor or MSP managing a customer's org
- A Genesys partner administering a client environment
- A parent company accessing a subsidiary org
- Genesys Product Support pairing with your org to troubleshoot

> 💡 **Telecom analogy:** Think of this like a Federated Trust between two PBX systems — a technician from System A uses their own credentials to manage System B without needing a local extension or station created for them in System B.

---

## Hard Constraints (Exam Critical)

| Constraint | Detail |
|---|---|
| **Same AWS region required** | Pairing is only possible between orgs in the same AWS region — cross-region pairing is not supported |
| **Max 25 users** | A maximum of 25 users from the requesting org can be authorized to access the target org |
| **No license consumption** | Authorized users do not consume a license seat in the target org — they are billed to their home org |
| **Admin tasks only** | Authorized users cannot receive ACD interactions (calls, chats, emails), use internal chat, or access the agent dashboard |
| **Division access** | Authorized users are automatically granted access to all divisions assigned to the roles they receive in the target org |

---

## How Pairing Works — Two Sides

Pairing involves two org administrators: one who **requests** access and one who **grants** it.

---

### Side 1: Creating a Pairing Request (Requesting Org)

The org that wants access initiates the request:

1. Admin → People & Permissions → **Authorized Organizations**
2. Click **Create Pair**
3. In the selection box, type and select the **users or groups** from your org who need access
4. Click **Create Pairing Link**
5. Click the **copy icon** to copy the unique URL
6. **Manually send the link** to an administrator of the target org (via email, chat, etc. — Genesys does not send it automatically)

> ⚠️ The pairing link must be sent out-of-band. Genesys does not email it to the target org.

---

### Side 2: Accepting a Pairing Request (Target Org)

The org being accessed approves and assigns permissions:

1. Open the pairing link received from the requesting org
2. Review the prompt and click **Yes, I authorize access**
3. You are taken to the paired organization management page
4. Click on the users or groups included in the request
5. **Assign the specific roles** they need (e.g., Admin, Architect, Telephony Admin)
6. Click **Save**

> ⚠️ **Until roles are assigned, authorized users have zero permissions** in the target org. Accepting the pairing alone grants no access.

---

## Role Assignment in the Target Org

Roles assigned to authorized users work the same as regular role assignments with one important note:

- The roles assigned determine what the authorized user can **do** in the target org
- Division access is **automatically scoped** to all divisions attached to those roles
- Roles should follow least-privilege — only assign what the partner/vendor actually needs

**Common role assignments for external access:**

| Scenario | Suggested Roles |
|---|---|
| Genesys support troubleshooting | Admin (temporary, revoke after session) |
| Partner building Architect flows | Architect access, flow designer permissions |
| Vendor monitoring dashboards | Read-only supervisor / analytics roles |
| MSP full management | Admin or Master Admin (use with caution) |

---

## Managing the Pairing

### Revoking Access
- Go to Admin → People & Permissions → **Authorized Organizations**
- Delete the pairing
- This **immediately terminates all active sessions** for the authorized users in your org

### Cloned Users
- Authorized users sometimes appear as **"Cloned Users"** in the org directory
- This is expected behaviour — most commonly seen when Genesys Product Support pairs with your org
- Cloned users are read-only representations; they do not consume license seats

---

## Pairing vs. Regular User Creation

| Factor | Authorized Org (Pairing) | Creating a User in Target Org |
|---|---|---|
| License in target org | Not consumed | Consumed |
| Identity / credentials | Home org credentials | Target org credentials (separate account) |
| ACD interactions | Not allowed | Allowed (if role permits) |
| Internal chat | Not available | Available |
| Max users | 25 | No pairing limit |
| Region requirement | Must match | No restriction |
| Best for | Temporary admin / vendor access | Permanent staff |

---

## Permissions Required

| Action | Permission |
|---|---|
| Create pairing request | People & Permissions admin access |
| Accept pairing request | Admin in the target org |
| Assign roles to authorized users | Authorization > Grant > Add in the target org |
| Delete/revoke pairing | Admin in the target org |

---

## See Also

- **Roles & Permissions** — role assignment principles that apply to authorized users
- **Divisions & Access Control** — how division scoping affects authorized user access
- **Organization Settings → Security & Compliance** — IP allowlists and auth controls that also apply to authorized users