- Product Introduction
- Purchase Guide
- Operation Guide
- Console Overview
- Organization Settings
- Department Management
- Member Account Management
- Viewing Member List and Basic Information
- Removing Organization Member
- Adding Organization Member
- Canceling Member Invitation
- Binding Tags to Members and Departments
- Creating Member Login Permission
- Configuring Member Login Permission
- Authorizing Sub-Users to Log in to Member Accounts
- Configuring Message Subscription for Created Member
- Binding Security Information for Members
- Deleting Created Organization Member
- Enabling Member Deletion Permission
- Member Finance Management
- Member Access Management
- Service Control Policy
- Overview
- Enabling Service Control Policy
- Creating Custom Service Control Policy
- Viewing Service Control Policy Details
- Modifying Custom Service Control Policy
- Deleting Custom Service Control Policy
- Binding Custom Service Control Policy
- Unbinding Custom Service Control Policy
- Disabling Service Control Policy
- Service Control Policy
- Resource Management
- Member Audit
- Identity Center Management
- API Documentation
- History
- Introduction
- API Category
- Making API Requests
- Organization Settings APIs
- Department and Member Management APIs
- ListOrganizationIdentity
- Unified Member Login APIs
- Organization Service Management APIs
- Identity Center Management APIs
- Identity Center User Management APIs
- Identity Center User Group Management APIs
- Identity Center Management SCIM Synchronization APIs
- Identity Center Single Sign-On Management APIs
- Identity Center Permission Configuration Management APIs
- ListRoleConfigurationProvisionings
- CreateRoleConfiguration
- ListRoleConfigurations
- ListPermissionPoliciesInRoleConfiguration
- GetRoleConfiguration
- RemovePermissionPolicyFromRoleConfiguration
- UpdateCustomPolicyForRoleConfiguration
- UpdateRoleConfiguration
- AddPermissionPolicyToRoleConfiguration
- DeleteRoleConfiguration
- Identity Center Multi-Account Authorization Management APIs
- Identity Center Sub-User Synchronization Management APIs
- Data Types
- Error Codes
- TCO API 2018-12-25
- History
- Introduction
- API Category
- Making API Requests
- Read APIs
- Write APIs
- UpdateOrganizationNode
- UpdateOrganizationMember
- SendOrganizationInvitation
- QuitOrganization
- MoveOrganizationMembersToNode
- DenyOrganizationInvitation
- DeleteOrganizationNodes
- DeleteOrganizationMemberFromNode
- DeleteOrganization
- CreateOrganization
- CancelOrganizationInvitation
- AddOrganizationNode
- AcceptOrganizationInvitation
- DeleteOrganizationMembers
- Data Types
- Error Codes
- FAQs
- Glossary
- Product Introduction
- Purchase Guide
- Operation Guide
- Console Overview
- Organization Settings
- Department Management
- Member Account Management
- Viewing Member List and Basic Information
- Removing Organization Member
- Adding Organization Member
- Canceling Member Invitation
- Binding Tags to Members and Departments
- Creating Member Login Permission
- Configuring Member Login Permission
- Authorizing Sub-Users to Log in to Member Accounts
- Configuring Message Subscription for Created Member
- Binding Security Information for Members
- Deleting Created Organization Member
- Enabling Member Deletion Permission
- Member Finance Management
- Member Access Management
- Service Control Policy
- Overview
- Enabling Service Control Policy
- Creating Custom Service Control Policy
- Viewing Service Control Policy Details
- Modifying Custom Service Control Policy
- Deleting Custom Service Control Policy
- Binding Custom Service Control Policy
- Unbinding Custom Service Control Policy
- Disabling Service Control Policy
- Service Control Policy
- Resource Management
- Member Audit
- Identity Center Management
- API Documentation
- History
- Introduction
- API Category
- Making API Requests
- Organization Settings APIs
- Department and Member Management APIs
- ListOrganizationIdentity
- Unified Member Login APIs
- Organization Service Management APIs
- Identity Center Management APIs
- Identity Center User Management APIs
- Identity Center User Group Management APIs
- Identity Center Management SCIM Synchronization APIs
- Identity Center Single Sign-On Management APIs
- Identity Center Permission Configuration Management APIs
- ListRoleConfigurationProvisionings
- CreateRoleConfiguration
- ListRoleConfigurations
- ListPermissionPoliciesInRoleConfiguration
- GetRoleConfiguration
- RemovePermissionPolicyFromRoleConfiguration
- UpdateCustomPolicyForRoleConfiguration
- UpdateRoleConfiguration
- AddPermissionPolicyToRoleConfiguration
- DeleteRoleConfiguration
- Identity Center Multi-Account Authorization Management APIs
- Identity Center Sub-User Synchronization Management APIs
- Data Types
- Error Codes
- TCO API 2018-12-25
- History
- Introduction
- API Category
- Making API Requests
- Read APIs
- Write APIs
- UpdateOrganizationNode
- UpdateOrganizationMember
- SendOrganizationInvitation
- QuitOrganization
- MoveOrganizationMembersToNode
- DenyOrganizationInvitation
- DeleteOrganizationNodes
- DeleteOrganizationMemberFromNode
- DeleteOrganization
- CreateOrganization
- CancelOrganizationInvitation
- AddOrganizationNode
- AcceptOrganizationInvitation
- DeleteOrganizationMembers
- Data Types
- Error Codes
- FAQs
- Glossary
The service control policy feature is disabled by default. You need to enable it before using it.
Background
After the service control policy feature is enabled, your organization will have the following changes:
All departments and members in your organization are bound to the system policy
FullQcloudAccess by default, which allows them to perform any operations on all your Tencent Cloud resources.When a department or member is created, it will be automatically bound to the system policy
FullQcloudAccess.After a Tencent Cloud account accepts the invitation to join your organization, it will be automatically bound to the system policy
FullQcloudAccess.When a member is removed, all service control policies bound to it will be unbound automatically.
Directions
1. Log in to the TCO console.
2. On the left sidebar, select Organization account > Service control policy.
3. Toggle on Service control policy.
Subsequent steps
You can create a custom service control policy (such as denying an operation on a resource) and bind it to a department or member in your organization. For detailed directions, see the following documents:
Yes
No
Was this page helpful?