vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Click Create in the "Create your test environment" section on the Before you begin page.
2. Enter the name of your private catalog, and click Create. The private catalog and its contents are visible only to the users you choose.







 Step 3: Set up team access 

If you want to enlist team members to help with the onboarding process, you need to assign them specific levels of IBM Cloud Identity and Access Management (IAM) access. To streamline the process, you can organize your team members into a single entity by adding them to an access group.



1. Click Assign in the "Assign access for your team" section on the Get started page.
2. Enter the name of the access group, and click Assign. Members of this group are assigned the following roles by default:



* Administrator on the catalog management service
* Editor on the Partner Center - Sell service
* Editor on the user management service
* Editor on the IAM access groups service
* Viewer on all account management services



For more information about the actions associated with each role, see [Actions and roles for account management services](https://cloud.ibm.com/docs/account?topic=account-account-servicesaccount-management-actions-roles).







 Step 4: Invite team members to your account 

After you create your access group, you can add team members to the group by inviting them to your account.



1. Click Invite in the "Invite users" section on the Get started page.
2. From the My Team page, click Invite users.
3. Select the user type:



* Business: A team member who can provide certain details, such as the product logo, description, and customer support experience.
* Technical: A team member who can import the product to your test environment, configure the deployment details, and validate it's ready for use.



4. Enter the email address of each user.
5. Click Invite.







 Next steps
Select a region and enter a name.
4. Click Save.



After you add users to an org, you can grant them permissions to the spaces. Similar to orgs, spaces also have a set of [Cloud Foundry roles](https://cloud.ibm.com/docs/account?topic=account-mngcfcfroles) with specific permissions that are assigned to team members:



* Space manager
* Space developer
* Space auditor



A user must be assigned at least one of the permissions in the space.





 Creating orgs by using the CLI 

You can create an organization by using the IBM Cloud® Command Line Interface. For detailed information about managing accounts, users in an account, and the org, space, and roles of public Cloud Foundry environments, see [Managing accounts, users, and Cloud Foundry orgs](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_accountibmcloud_account_org).



1. Log in, and select the account.

ibmcloud login
2. Create an organization by running the [ibmcloud account org-create](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_accountibmcloud_account_org_create) command, where ORG_NAME is the name of the organization to be created, and -r, --region REGION is the region name.

ibmcloud account org-create ORG_NAME [-r, --region REGION]

For example, the following command creates an organization that is named IBM.

ibmcloud account org-create IBM

If REGION is not specified, the name is default to current region.



This operation can be run only by the account owner.





 Creating spaces by using the CLI 

You can also create spaces by using the IBM Cloud® CLI.



1. Log in, and select the account.

ibmcloud login
2.
Replace TOKEN with the IBM Cloud IAM token that you retrieved from the access_token field of your API output in the previous step. In your API output, you can find the ID of your IBM Cloud account in the resources.metadata.guid field.

GET https://accounts.cloud.ibm.com/coe/v2/accounts

Header
: 

* Content-Type: application/json
* Authorization: bearer TOKEN
* Accept: application/json



The following example shows the output of the previous request.

{
"next_url": null,
"total_results": 5,
"resources": [ !!!!!!!!
{
"metadata": {
"guid": "<account_ID>",
"url": "/coe/v2/accounts/<account_ID>",
"created_at": "2016-09-29T02:49:41.842Z",
"updated_at": "2018-08-16T18:56:00.442Z",
"anonymousId": "1111a1aa1a1111a1aa11aa11111a1111"
},
"entity": {
"name": "<account_name>",
3. Generate a new IBM Cloud IAM token that includes your IBM Cloud credentials and the account ID that you want to work with.
If you use an IBM Cloud API key, you must use the IBM Cloud account ID the API key was created for. To access clusters in other accounts, log in to this account and create an IBM Cloud API key that is based on this account.

POST https://iam.cloud.ibm.com/identity/token

Header
: <-- <ul> -->

* Content-Type: application/x-www-form-urlencoded
* Authorization: Basic Yng6Yng=Yng6Yng= equals the URL-encoded authorization for the username bx and the password bx.

<-- </ul> -->

Body for IBM Cloud username and password
[Customizing your IBM Cloud dashboard](https://cloud.ibm.com/docs/account?topic=account-tutorial-custom-dash)Customizing your IBM Cloud dashboard

This tutorial walks you through how to customize your dashboard in the IBM Cloud® console to ensure that what is displayed is relevant to you. By completing this tutorial, you learn how to create a new dashboard, add and organize widgets, duplicate a dashboard, share a dashboard with other users, and delete unused dashboards.

Managing your account, resources, and access



* 10 minutes
* 2021-09-24



[Assigning access to resources by using access groups](https://cloud.ibm.com/docs/account?topic=account-access-getstarted)Assigning access to resources by using access groups

Get up and running quickly with IBM Cloud Identity and Access Management (IAM) by setting up access groups for quick access assignments, inviting users to your account, and managing their access.

Managing your account, resources, and access



* 10 minutes
* 2023-06-01



[Controlling access to resources by using tags](https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial)Controlling access to resources by using tags

This tutorial guides you through the steps to centrally manage access to the resources in your account at scale. By completing this tutorial, you learn how to create an access management tag, add the tag to selected resources, and define a policy to assign access to resources based on the tags on those resources.

Managing your account, resources, and access



* 10 minutes
* 2022-06-13



[Managing access for apps in compute resources](https://cloud.ibm.com/docs/account?topic=account-trustedprofile-compute-tutorial)Managing access for apps in compute resources

This tutorial guides you through the steps to centrally manage fine-grained authorization for all applications that are running in a compute resource without creating service IDs or managing the API key lifecycle for applications. By completing this tutorial, you learn how to create a trusted profile, establish trust with compute resources based on specific attributes, and define a policy to assign access to resources.
A unique name is required to differentiate access groups in the account. To create an access group, complete the following steps:



1. In the IBM Cloud® console, click Manage > Access (IAM), and select Access Groups.
2. Click Create.
3. Enter a unique name to identify your access group, an optional description, and click Create.



Next, continue to set up your groups by adding users, service IDs, or trusted profiles. You can add users manually or by [creating dynamic rules](https://cloud.ibm.com/docs/account?topic=account-rules&interface=ui). Or, you can start assigning the group access, and decide who you want to add to the access group later.

You can delete a group by selecting the Remove group option. When you remove a group from the account, you are removing all users and service IDs from the group and all access that is assigned to the group.





 Creating an access group by using the CLI 

To create an access group by using the CLI, you can use the [ibmcloud iam access-group-create](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_access_group_policy_create) command.

ibmcloud iam access-group-create GROUP_NAME [-d, --description DESCRIPTION]

A unique name is required to differentiate access groups in the account.





 Creating an access group by using the API 

You can programmatically create access groups by calling the [IBM Cloud® Identity and Access Management (IAM) Access Groups API](https://cloud.ibm.com/apidocs/iam-access-groupscreate-access-group) as shown in the following sample request. The example creates an access group for managers in the account:



* Curl
* Java
* Python
* Go
* Node
Complete the following steps to grant a user or service ID permissions to work with the IBM Cloud Monitoring Workload Protection service within the context of a team:



 Prerequisites 

Your user ID needs administrator platform permissions to manage the IBM Cloud Monitoring Workload Protection service. The account owner can grant user access to the account for the purposes of managing user access and managing account resources. [Learn more](https://cloud.ibm.com/docs/account?topic=account-userroles).





 Step 1. Create an access group 

Do the following to create an access group:



1. From the menu bar, click Manage > Access (IAM), and select Access Groups.
2. Click Create.
3. Enter a name and optional description for your group, and click Create.



You can delete a group by selecting the Remove group option. When you remove a group from the account, you are removing all users and service IDs from the group and all access that is assigned to the group.

To create an access group by using the CLI, you can use the [ibmcloud iam access-group-create](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iamibmcloud_iam_access_group_create) command.

ibmcloud iam access-group-create GROUP_NAME [-d, --description DESCRIPTION]





 Step 2. Add permissions to view IBM Cloud Monitoring Workload Protection instances in the Observability UI 

After you set up your group, you can assign a common access policy to the group. You must add permissions to view IBM Cloud Monitoring Workload Protection instances in the Observability UI.

Any policy that you set for an access group applies to all entities, users, and service IDs within the group.

You can assign the policy by using the UI or through the command line.

When you define the policy, you need to select a platform role. Platform management roles cover a range of actions, including the ability to create and delete instances, manage aliases, bindings, and credentials, and manage access.
To re-create the migrated permissions that are available in each access group, you can assign policies to individual users or create new access groups in your account. The benefit of creating a new access group is that you can choose to combine a set of permissions for one access group rather than manage a set of access groups with a granular scope of access set for each. For this example, the steps explain how to create a new access group and assign an equivalent access policy for viewing the account summary and viewing all support cases.

Re-creating these permissions by assigning new IAM access policies for the account management services might include permissions in addition to the single permission that is available in the migrated permission access group. For example, if you assign a user the viewer role on the Billing service, that user can do more than view the account summary. For a full list of the actions that are allowed for each role, see [Assigning access to account management services](https://cloud.ibm.com/docs/account?topic=account-account-servicesaccount-management-access).

To create an access group, complete the following steps:



1. In the IBM Cloud console, click Manage > Access (IAM), and select Access groups.
2. Click Create.
3. Enter a name and an optional description for your group, and click Create.
4. Click Add users.
5. Select the users that you want to add from the list, and click Add to group. You can complete the same action from the Service IDs tab if you want to add any service IDs to the group.



After you set up your group with users and service IDs, assign access to the group. Remember, any policy that you set for the group applies to all members of the group.



1. Click the Access tab.
2. Click Assign access.
3. From the services, select Billing and click Next.
4. Select the Viewer role and click Review.
5. Click Add.
6. To assign a second access policy for the ability to view support cases, select the Support Center service.
7. Select the Viewer role and click Review.
To do this, an account admin must follow these steps:



* Log in to your [IBM Cloud](https://cloud.ibm.com/) account.
* Select Manage > Access (IAM), then click Users.
* Click the user name, then click the Classic infrastructure tab.
* From the Devices and VPN subnets views, you can provide the user with VPN access to all the needed devices or subnets.

If you have more than 64 subnets on an account, you will not be able to access your device/subnet. When you have your SSL VPN subnet assignment assigned to Automatic, it only provides you access with the first 64 subnets on the account; the other subnets aren't included. To fix this issue, you can set your SSL VPN subnet assignment to Manual and manually select the devices/subnets where your user need access.

To check the number of subnets on your account, go to the [Subnets](https://cloud.ibm.com/networking/subnets) page, then locate the number before the word “Items” at the end of the page. This is the number of subnets that you have on the account.



4. If you were not able to ping the DNS server, log out of the VPN and toggle your SSL VPN access from on to off, then off to on. For more information click [Activating or deactivating SSL VPN access for a user](https://cloud.ibm.com/docs/iaas-vpn?topic=iaas-vpn-activate-or-deacivate-ssl-vpn-access-for-a-user).
5. If you have exhausted all the above steps and are still running into the issue, create an [IBM Support case](https://cloud.ibm.com/unifiedsupport/cases/form).
Confirm that the catalog includes all products by clicking the catalog name > Manage filters. Then, check that Include all products in the IBM Cloud catalog is selected in Step 1: Select to include or exclude all products in the IBM Cloud catalog.







 Creating a private catalog with select products included by using the console 

Complete the following steps to create a catalog that includes a specific set of products in the IBM Cloud catalog:



1. Go to Manage > Catalogs, in the IBM Cloud console, and click Create a catalog.
2. Select the Product (default) catalog type.
3. Enter a name and description.
4. Click Create.
5. Click the catalog name > Manage filters.
6. Select Exclude all products in the IBM Cloud catalog in Step 1: Select to include or exclude all products in the IBM Cloud catalog.
7. Skip step 2, and click Add in Step 3: Add exceptions to the rules.
8. Make sure Include is selected as the condition, and then individually select the products you want users to access. In the case of our example project, you select Watson Assistant, Speech to Text, and Text to Speech.







 Setting the visibility of the IBM Cloud catalog by using the console 

Now that you've created your private catalogs, complete the following steps to turn off visibility of the public catalog to all users in your account.



1. Click Catalogs in the breadcrumb.
2. Click Settings.
3. Set IBM Cloud catalog to Off.
4. Confirm that your filters and settings are correctly applied by going to the public catalog, and expanding the catalog switcher. Only the private catalogs in your account should be displayed in the list.



You can update which products are included or excluded at any time by updating your private catalog's settings.





 Branding your private catalog with a custom banner 

You can enhance the look and feel of your private catalog to match your brand by adding a custom image to your private catalog's banner. All users who are given access to your private catalog can see the custom banner when they go to the private catalog to search for products, instead of the default IBM Cloud banner.
Manage settings for catalogs across your account. Go to Manage > Catalogs to access catalog management. Then, click Settings.

Turn the IBM Cloud catalog off or on with one click. From the Settings page, you can control whether users in your account can access the IBM Cloud catalog or not. Toggle on the IBM Cloud catalog to make the catalog available for users in your account.

Add rules for fine-grained control. From the Settings page, you can customize what's available in the IBM Cloud catalog to users in your account. You can exclude products from the IBM Cloud catalog based on specific filters, such as the category. Click Edit for the Category filter and select Exclude Storage to hide products that are categorized as Storage. Click Update to save your changes.

Create private catalogs for your team. Click Private catalogs then, click Create. Provide a name and a description for your private catalog.

Start with an empty catalog or include products from IBM Cloud. After providing a name and a description of your private catalog, select whether you want to create an empty catalog or a catalog with all available products in your account. Then, click Create.

Protect your data within IBM Cloud by setting up automatic security checks in our Security and Compliance Center. Open the navigation menu and click Security and Compliance to go to the Security and Compliance Center.

Your software and ours, together at last, and curated by you.
Depending on your organization, deploying an architecture might require access to another account by using a trusted profile and coordinating with administrators in multiple accounts. If the IBM Cloud Projects service in another account needs access to your account to deploy an architecture, use trusted profiles and service IDs to authorize deployments in your account.





 Before you begin 

Make sure that you create the trusted profile in the account where you want to deploy the architecture. If you have the following access, you can create trusted profiles:



* Account owner
* Administrator role on all account management services
* Administrator role on the IAM Identity Service. For more information, see [IAM Identity service](https://cloud.ibm.com/docs/account?topic=account-account-servicesidentity-service-account-management).



All users have access to create a service ID in an account to which they are a member.





 Creating the trusted profile 

Create a trusted profile that can do the following:



* Create a service ID
* Create and delete API keys for the service ID
* Deploy the deployable architecture



Complete the following steps:



1. Find the project CRN. The CRN is used to authorize deployments to a target acccount.



* To find the project CRN while you're [editing a project configuration](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-config-projecthow-to-config), click the tooltip icon on the trusted_profile_id field and copy the CRN.
* Otherwise, go to Menu![Menu icon](https://cloud.ibm.com/docs-content/v1/content/d4595e5202a9a27767cf034e81b038cdf772e0d5/icons/icon_hamburger.svg) > Projects and clicking the relevant project. Click Manage > General and copy the CRN.



2. Confirm that you are in the target account to which the project deploys.
3. In the IBM Cloud® console, click Manage > Access (IAM), and select Trusted profiles.
* Dedicated account data delete request (Visual Recognition only)



Follow these steps to create a SAR.



1. Log in to the [IBM Cloud Service Portal](https://watson.service-now.com/wcp?id=csp_homepage). You need a IBM Cloud account.
2. Click Create a Case.
3. Enter the Watson services that are affected by the request. You can include multiple services in the same request.
4. Add the following items to the Case Description:



* Enter DR Request for data rights requests in the EU. For other requests, enter GDPR SAR Request.
* Enter the type of request:



* Customer Data request
* Audit Log request. For audit log requests, specify the duration period: 30, 60, or 90 days.
* Customer Data & Audit Log request
* Visual Recognition Data Delete request



* Include your IBM Cloud account IBMid.
* Include the GDPR user customer_id (used in the GDPR labeling process). Submit a separate request for each customer ID. If you have requests for multiple customers, create a separate request for each.





A few minutes after you open a support ticket, you will receive an email notification. Follow the instructions in the email for further communications about the issue.
Users can continue working with resources in the account unaffected.







 Step 2: Create an enterprise structure with account groups 

Use account groups to [organize related accounts](https://cloud.ibm.com/docs/account?topic=account-enterprise-organize). The second and third tier of the Example Corp. enterprise hierarchy contain the Marketing, Development, Sales, Design, and Engineering account groups. Complete the following steps to create the account groups:



1. From the enterprise dashboard, click Accounts to view accounts and account groups in the enterprise.
2. In the account group section, click Create.
3. Enter the account group name, such as Marketing.
4. In the contact field, enter the IBMid for the user that you want to be the main contact for the account group. Because an account group can't contain any resources, it doesn't have an owner like an account.
5. Select Example Corp as the parent account.
6. Click Create.



Repeat the steps to create the Sales, Development, Design, and Engineering account groups. When you create the Design and Engineering account groups, make sure that you add Development as the parent account group.





 Step 3: Import existing accounts 

Now that you created an enterprise structure, you can import an existing account to the enterprise. When you import an account, it is permanently added to the enterprise. Like when you create an enterprise, billing for the imported accounts transitions to being managed by the enterprise, but its users and resources remain the same. For details, see [Importing existing accounts](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-enterprise-add).

To import an existing account, the following access is required:



* Within the account to be imported, you must be the account owner or have the Administrator role on the Enterprise and Billing account management services within the account.
* Within the enterprise account, you need the Editor or Administrator role on the Enterprise service and the Administrator role on the Billing service.



Complete the following steps to import the example UX-UI account to the Design account group:



1.