Manage users in the Apigee UI

This page applies to Apigee and Apigee hybrid.

View Apigee Edge documentation.

This topic describes how to add users to an environment, remove users from an environment, and update user roles in an environment, using the UI.

About role scope

You can add users to Apigee organizations using the Google Cloud console. When you do this, the user is granted the same access to all environments in the organization. However, you can refine each user's access by using the Apigee UI.

The Apigee UI lets you assign roles to users that are specific to a given environment. Instead of each user having the same role in all environments of an organization, you can assign a specific role or roles for that user for each environment.

When you first configure Apigee and create the Google Cloud project to which the Apigee organization is bound, you typically add a few users with different roles like API Admin and Environment Admin. Because these users are defined at the Cloud Project project level, they can access all environments with the roles granted.

If you grant access using the Apigee UI, you can set roles of existing users at the environment level.

Note: Before you can add a new user (and specify environment-specific access for that new user) in the UI, you must grant that user access to the Google Cloud project, as described in Managing access in Google Cloud.

Roles you assign in the Google Cloud project apply to all environments. Roles you assign in the UI apply only to the selected environment.

The roles drop-down list displays only predefined roles.

Note: Roles assigned to specific environments, as explained in this topic, only affect resources that are under the resource hierarchy that includes Apigee Environment resources. You can identify which resources are in the Environment resource hierarchy by examining the Apigee API documentation. For example, the organizations.environments.deployments resource is in the Environments resource hierarchy.

For all other permissions for Apigee resource access, see Managing access in Google Cloud.

Add user accounts in the UI

Note: There is a new version of the Apigee UI, which is integrated with the Google Cloud console. The new UI is called Apigee in Cloud console. The instructions in the first two tabs below explain how to use either Apigee in Cloud console or classic Apigee.

Apigee in Cloud console

To specify user permissions for an environment:

1. Ensure that you have already added the user to your Google Cloud project. For information on adding users to a Google Cloud project, see Granting, changing, and revoking access to resources.
2. Open the Apigee UI in Cloud console in a browser.
   Note: If you see the message below at the top of the UI, you need to provision your Apigee organization before proceeding further.

   

   After you have provisioned Apigee, close the UI and reopen the Apigee UI in Cloud console.

3. In the left navigation pane, click Management > Environments.
4. Select the environment you wish to edit from the list of available environments.
5. Click the Access tab on the Environment details page.

   The UI displays a list of current user accounts and roles for the selected environment.

6. Click +Grant Access.

   The Grant Access pane displays.

7. Enter the user's email account in the first field. This email address is typically one of the following:
   • An individual Google account (for example, [e-mail]). All Gmail accounts are Google accounts, but you can also register email addresses with different domains as Google accounts.
   • A Google Group alias. For example, [e-mail].
   • A service account. For example, [e-mail].
   • A Google Workspace domain. For example, [e-mail], where example.com is a domain that you used when you signed up for Google Cloud services.
8. Select a role from the Role(s) drop-down list and click OK. You can add more than one role for each user. For details on available roles, see Apigee roles and IAM permissions reference.
9. Click Grant.
10. Repeat this process for each environment for which you want to specify the user's role.

You can remove a user account from an environment using the UI, but that user account will still have the access that it was granted in the Google Cloud console unless you also remove the user from the Console by default.

Classic Apigee

To specify user permissions for an environment:

1. Ensure that you have already added the user to your Google Cloud project. For information on adding users to a Google Cloud project, see Granting, changing, and revoking access to resources.
2. Open the Apigee UI in a browser.
3. Select Admin > Environments > Access in the left navigation menu.
4. Select the environment name from the drop-down list.

   The UI displays a list of current user accounts and roles for the selected environment:

   

5. Click +Grant Access.

   The Grant Access to Environment pane displays:

   

6. Enter the user account's email address in the first field. This email address is typically one of the following:
   • A Google account (for example, [e-mail]). All Gmail accounts are Google accounts, but you can also register email addresses with different domains as Google accounts.
   • A Google Group alias. For example, [e-mail].
   • A service account. For example, [e-mail].
   • A Google Workspace domain. For example, [e-mail], where example.com is a domain that you used when you signed up for Google Cloud services.
7. Select a role from the Role drop-down list and click Add. You can add more than one role for each user. For details on available roles, see Apigee roles and IAM permissions reference.
8. Repeat this process for each environment for which you want to specify the user's role.

You can remove a user account from an environment using the UI, but that user account will still have the access that it was granted in the Google Cloud console unless you also remove the user from the Console by default.

Remove user accounts

Removing a user at the environment level does not remove the user at the Google Cloud project level. As a result, the user can still access all environments with their Google Cloud project level permissions.

To revoke the user's access entirely, you must remove them from the Google Cloud project as described in Revoking Access to Google Cloud Platform.

Apigee in Cloud console

To remove a user from an environment:

1. Open the Apigee UI in Cloud console in a browser.
2. In the left navigation pane, click Management > Environments.
3. Select the environment name you wish to edit from the list of available environments.
4. Click the Access tab on the Environment details page.

   The UI displays a list of current user accounts and roles for the selected environment.

5. In the user's row, click the three-dot menu under Actions and select Remove.

   The UI displays a confirmation dialog box.

6. Click Remove Access.

   The UI removes that user from the environment.

   Note: Removing a user at the environment level does not remove the user at the Google Cloud project level. To remove a user entirely, you must also remove that user from the Google Cloud project by using the Console, as described in Revoking Access to Google Cloud Platform.

Classic Apigee

To remove a user from an environment:

1. Open the Apigee UI in a browser.
2. Select Admin > Environments > Access in the left navigation menu.
3. Select the environment name from the drop-down list.

   The UI displays a list of current users for the selected environment.

4. In the user's row, click Delete.

   The UI displays a confirmation dialog box:

   

5. Click Revoke.

   The UI removes that user from the environment.

   Note: Removing a user at the environment level does not remove the user at the Google Cloud project level. To remove a user entirely, you must also remove that user from the Google Cloud project by using the Console, as described in Revoking Access to Google Cloud Platform.

Change user roles in the UI

You can change a user's role on a per-environment basis by using the UI. This includes adding additional roles to a user account or removing one or more roles from the user account.

Apigee in Cloud console

To change a user's roles for an environment:

1. Open the Apigee UI in Cloud console in a browser.
2. In the left navigation pane, click Management > Environments.
3. Select the environment name you wish to edit from the list of available environments.
4. Click the Access tab on the Environment details page.

   The UI displays a list of current user accounts and roles for the selected environment.

5. In the user's row, click the three-dot menu under Actions and select Edit.

   The UI displays the Manage Roles pane.

6. Do one of the following:
   1. To remove a role: Clear the checkbox next to that role.
   2. To add another role: Select the checkbox next to the role you wish to add.
7. Click OK.
8. Click Update.

   The UI applies your changes to the user in that environment.

   Note: Changing roles at the environment level does not affect the user's roles at the Google Cloud project level. For information on changing roles at the Google Cloud project level, see Granting, changing, and revoking access to resources.

Classic Apigee

To change a user's roles for an environment:

1. Open the Apigee UI in a browser.
2. Select Admin > Environments > Access in the left navigation menu.
3. Select the environment name from the drop-down list.

   The UI displays a list of current users for the selected environment.

4. In the user's row, click Edit.

   The UI displays the Manage Roles dialog box:

   

5. Do one of the following:
   1. To remove a role: Click Cancel next to that role.
   2. To change a role: Select a new role from the drop-down list of roles.
   3. To add another role: Click Add another role.
6. Click Apply.

   The UI applies your changes to the user in that environment.

   Note: Changing roles at the environment level does not affect the user's roles at the Google Cloud project level. For information on changing roles at the Google Cloud project level, see Granting, changing, and revoking access to resources.