Administration: refresh the Accounts concept page - #21113
Open
jkodroff wants to merge 1 commit into
Open
Conversation
The Accounts page sat in Administration → Concepts without explaining the concept. It opened on a signup click-path, never defined what an account is, never distinguished an account from an organization, and never mentioned the individual organization you get on signup. Its last content change was a one-line addition in March; the MFA and email-verification sections date to 2024. Rewrite it concept-first, verified against pulumi-service rather than inferred: - Define an account, and separate it from an organization. - Explain individual organizations, including that org-managed (SAML/SCIM) users don't get one — documented nowhere previously. Replaces the unintelligible "Subscription" section. - Enumerate how accounts are created: signup, invitation, SAML JIT, SCIM, agent accounts. One signup link instead of six per-identity links. - Document account identity, and renaming (which renames the individual organization with it, is refused mid-update, and is unavailable to SAML users). - Give email verification a reason to exist: list what EnforceVerifiedUserMiddleware actually gates — MFA enrollment, connecting an identity, org invites, org tokens, OIDC issuers, Deployments, agent pools. - Correct the password rules (10-160 chars, can't match username or email) and MFA scope (TOTP plus a single rotating recovery code; requires a password, so email/password accounts only). - Retitle to "Accounts" to match the other Concepts sections. Remove the four screenshots, which were stale and used by no other page, and the `identities` shortcode, whose markdown variant rendered only "This content is best viewed on the web" — so the provider list was invisible in llms.txt. It's a plain list now. Adjacent fixes: - Move "Deleting your account" off the Organizations page and retarget the FAQ link to it. - Standardize on "individual organization" (the term used by the product's rename and delete dialogs and the OpenAPI spec) across Organizations and the IaC Pulumi Cloud page, which were split between "individual account", "personal account", and "personal organization". Preserves all 10 aliases and the #adding-new-identities anchor that Neo code reviews deep-links. Fixes #21109 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014KGSEaQT4xEHxEsEceKccN
jkodroff
marked this pull request as ready for review
August 25, 2026 01:46
github-actions
Bot
added
review:triaging
![unblocked[bot]](https://avatars.githubusercontent.com/in/166219?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
1 issue found.
About Unblocked
Unblocked has been set up to automatically review your team's pull requests to identify genuine bugs and issues.
📖 Documentation — Learn more in our docs.
💬 Ask questions — Mention @unblocked to request a review or summary, or ask follow-up questions.
👍 Give feedback — React to comments with 👍 or 👎 to help us improve.
⚙️ Customize — Adjust settings in your preferences.
| - An email address and password | ||
| - Single sign-on through a SAML 2.0 identity provider | ||
|
|
||
| SAML single sign-on is configured by an organization admin, not by individual users. If your company uses it, your admin sets up the [SAML integration](/docs/administration/guides/saml/) and tells you which organization name to sign in with. Note that Pulumi supports only one Pulumi Cloud organization per SCIM application, so an admin managing several organizations configures each one separately. |
Contributor
There was a problem hiding this comment.
This paragraph is about SAML single sign-on, but the last sentence cites a SCIM-specific limitation ("one Pulumi Cloud organization per SCIM application"). The sso-scim-limits-info shortcode that this sentence paraphrases lives on the SCIM page and is specific to SCIM provisioning — it is not a SAML constraint.
A reader learning about SAML sign-in will be confused by an unexplained jump to SCIM terminology. Either:
- Replace "SCIM application" with "SAML application" if the same one-org-per-app constraint applies to SAML configurations, or
- Remove the sentence from this paragraph entirely and leave it to the SCIM page where it already exists.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Optional style suggestions from the pre-merge review — apply or dismiss; none of them block.
Generated by Claude Code
| * Manage your profile settings, including your account password, and subscriptions | ||
| * [Add an organization](/docs/administration/concepts/organizations/) backed by Atlassian, GitHub, GitLab, or a SAML 2.0-compatible identity provider, such as Active Directory, Okta, or Google Workspace. | ||
| * [Manage your projects and stacks](/docs/iac/concepts/stacks/) | ||
| When you sign up for Pulumi Cloud, Pulumi creates an _individual organization_ for you automatically. It is named after your username, and it is the organization your work lands in until you create or join one with other people in it. It appears in the organization menu alongside every collaborative organization you belong to. |
Contributor
There was a problem hiding this comment.
[style] wordiness — Drops a repeated 'it is' in a compound predicate
Suggested change
| When you sign up for Pulumi Cloud, Pulumi creates an _individual organization_ for you automatically. It is named after your username, and it is the organization your work lands in until you create or join one with other people in it. It appears in the organization menu alongside every collaborative organization you belong to. | |
| When you sign up for Pulumi Cloud, Pulumi creates an _individual organization_ for you automatically. It is named after your username, and is the organization your work lands in until you create or join one with other people in it. It appears in the organization menu alongside every collaborative organization you belong to. |
| To edit your profile information: | ||
| ## How accounts are created | ||
|
|
||
| An account comes into existence in one of several ways: |
Contributor
There was a problem hiding this comment.
[style] weasel word — The list below is complete, so name it
Suggested change
| An account comes into existence in one of several ways: | |
| An account comes into existence in one of these ways: |
| ## Switching between organizations | ||
|
|
||
| The organization menu displays your individual account and all of the organizations you belong. | ||
| The organization menu displays your individual organization and all of the organizations you belong to. |
Contributor
There was a problem hiding this comment.
[style] wordiness — 'all of the' reduces to 'all the'
Suggested change
| The organization menu displays your individual organization and all of the organizations you belong to. | |
| The organization menu displays your individual organization and all the organizations you belong to. |
Contributor
Pre-merge Review — Last updated 2026-08-25T01:49:55ZTip Summary: This is a near-total rewrite of the Accounts concept page under Review confidence:
Investigation log
✏️ 3 one-click style suggestions are posted inline — apply them from the Files changed tab, individually or with Add suggestion to batch. 🔍 Verification trail67 claims extracted · 39 verified · 14 unverifiable · 0 contradicted · 1 framing-drift
🚨 Outstanding in this PRNo outstanding findings in this PR.
|
Contributor
📋 Triaged verifier findingsI double-checked these and realized they weren't real findings — click to expand
💡 Pre-existing issues in touched files (optional)
✅ Resolved since last reviewNo items resolved since the last review. 📜 Review history
Important Please don't hide, resolve, or delete this comment! It breaks things! 📖 How pre-merge review works — the full lifecycle, short-circuits, and escape hatches. |
github-actions
Bot
added
review:no-blockers
Collaborator
|
Your site preview for commit 5bc5ff0 is ready! 🎉 http://www-testing-pulumi-docs-origin-pr-21113-5bc5ff0e.s3-website.us-west-2.amazonaws.com Changed pages: |
Collaborator
Lighthouse Performance ReportCommit: 5bc5ff0 | Metric definitions
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #21109.
The Accounts page sat in Administration → Concepts without explaining the concept. It opened on a signup click-path, never defined what an account is, never distinguished an account from an organization, and never mentioned the individual organization you get on signup. Its last content change was a one-line addition in March; the MFA and email-verification sections date to 2024.
What changed
content/docs/administration/concepts/accounts.mdis rewritten concept-first. Every factual claim was verified againstpulumi-servicerather than inferred — citations below.New/rewritten sections
## Subscriptionsection the issue called out.Corrections to existing content
Removals
identitiesshortcode. Its.markdown.mdvariant rendered only "This content is best viewed on the web", so the provider list was invisible in/llms.txt. It's a plain markdown list now, and the shortcode had no other callers.Terminology
The product is split three ways — the rename and delete dialogs and the OpenAPI spec say "individual organization"; the settings UI says "personal organization"; the backend says "single-user organization". Docs were split between "individual account", "personal account", and "personal organization". Standardized on individual organization across
organizations.mdandiac/concepts/pulumi-cloud.md.Source citations
cmd/service/api/validation.go:551-576cmd/service/api/mfa.go:42,61-97,284-287SecondFactorEnrollmentHandler→verifyPasswordConfirmation(users.go:1779)EnforceVerifiedUserMiddleware(users.go:2358),routing.go:378isOmuinuser-settings.component.ts:921;IsOrgManaged(users.go:913)newUserAccountFromSAMLsetsManagedBy(users.go:1725-1756)email-signup-form.component.ts:308— "Let the backend derive and deduplicate the login name from the email"rename-organization.dialog.html:20-39;shouldRenameAccountBeDisabled(account-profile.component.ts:277)delete-organization.dialog.html:12-19Preserved
aliases:— byte-identical.{#adding-new-identities}anchor, deep-linked fromcontent/docs/ai/neo/code-reviews/_index.md:34.Verification
make lintpasses. Rendered and checked against a local server: title, H1, all four callouts, the pinned anchor, no unrendered shortcodes, no orphaned image references, and the retargeted FAQ link.Known follow-up, not in this PR
28 tutorial and blog prerequisites link to
/docs/pulumi-cloud/accounts#access-tokens. The alias resolves to this page, but that heading moved to/docs/administration/concepts/access-tokens/, so the fragment is dead and readers land mid-page on the wrong topic. Left alone deliberately — happy to fold it in or file it separately.🤖 Generated with Claude Code
https://claude.ai/code/session_014KGSEaQT4xEHxEsEceKccN