# Manage Customer Access

:::important Alpha Feature
Features described on this page are in alpha and subject to change. Some capabilities might require additional access.
:::

This topic describes how to control which customers can access the new Enterprise Portal and how to manage their portal users from the Vendor Portal.

## Enabling Enterprise Portal for customers

For vendors using both Classic and New Enterprise Portal (mixed mode), customer access is controlled per-customer:

- On the customer's **Enterprise Portal access** tab, toggle **Enable Enterprise Portal for this customer** to grant access
- Team admins can use the **Portal Version** toggle to choose whether the customer sees Classic or New
- Customers on the New portal access it at `{appSlug}.enterpriseportal.app` (or your custom domain)

For vendors on the New Enterprise Portal only, all customers can access the portal. You do not need an app-level or per-customer enable toggle.

## Inviting users

To invite a customer's end user to the portal:

1. Go to **Customers > [Customer Name] > Enterprise Portal access**
1. In the **Customer Users** section, click **+ Invite user**
1. Enter the user's email address and click **Send invite**
1. The user receives an email with an invitation link to activate their account

You can also enable **Automatically invite customer email to Enterprise Portal on creation** so that every new customer with an email address receives an invite automatically.

For teams using only the New Enterprise Portal, go to **Enterprise Portal > Customer Access**. In the **Customer invitations** section, enable automatic invitations. In mixed mode, automatic invitations require the app-level **Enable Enterprise Portal for all customers** setting.

For vendors in mixed mode (both Classic and New enabled), the customer creation screen includes a **Use new Enterprise Portal for this customer** checkbox. When checked, the customer is enrolled in the New portal and any auto-invite email points them to the New portal URL instead of Classic. This checkbox is only visible to team admins. When unchecked or not visible, new customers default to Classic.

## Removing users

To remove a user from a customer's portal team:

1. Go to **Customers > [Customer Name] > Enterprise Portal access**
1. In the **Customer Users** table, click the menu icon (**...**) next to the user
1. Select **Remove user**

## Domain restrictions

Restrict which email domains can be invited to a customer's portal:

1. Go to **Customers > [Customer Name] > Enterprise Portal access**
1. In the **Authentication** section, enable **Domain Restrictions**
1. Add one or more allowed email domains (e.g., `acme.com`)

Only users with email addresses matching an allowed domain can be invited. This prevents accidental invitations to personal email addresses or unauthorized domains.

## SAML authentication (Alpha)

Allow customers to use their corporate identity provider for portal login:

1. Go to **Customers > [Customer Name] > Enterprise Portal access**
1. In the **Authentication** section, enable **SAML Authentication**
1. The customer can then configure their IdP details (metadata URL, certificates) from within the Enterprise Portal's team settings

SAML supports just-in-time user provisioning. When a user logs in via SAML for the first time and their email matches a pending invitation, their account is automatically activated.

## Service accounts

Service accounts provide programmatic access to the Enterprise Portal (e.g., for CI/CD pipelines pulling install commands or registry credentials).

- View and manage service accounts on the customer's **Enterprise Portal access** tab under **Customer Service Accounts**
- Service accounts are created automatically when a customer starts a new installation from the portal
- Vendors can revoke service accounts from the Vendor Portal

## Emails

For information about configuring a custom email sender, customizing email templates, sending release notifications, and viewing email delivery history, see [Customize Customer Emails](/vendor/enterprise-portal-v2-emails).