Skip to main content
When you first sign up for Ultra Hub, the onboarding wizard guides you through creating your organization structure.

​
Onboarding Steps

1

Create Organization

Choose a name and slug for your organization. The slug is used in URLs and API calls.
  • Name: Your company or team name (e.g., “Acme Corp”)
  • Slug: URL-friendly identifier (e.g., “acme-corp”)
Creating the organization also turns on every built-in guardrail in Monitor mode and anomaly detection at a 24-hour cadence, both at the organization scope — see New Organization Defaults. Nothing is blocked or redacted until you promote a guardrail to a stricter mode.
2

Create Team

Teams are groups within your organization. Start with one team and add more later.
  • Name: Team name (e.g., “Engineering”)
3

Create Workspace

Workspaces contain devices and their telemetry data. Use workspaces to separate environments.
  • Name: Workspace name (e.g., “Development”)
  • Typical setup: separate workspaces for Development, Staging, Production
4

Complete

The wizard offers the Ultra download, along with the terminal install command, and points you at what to do next:
  • Link a device: install Ultra on your machine and connect it to your workspace
  • Invite your team: add team members to collaborate on policies and monitoring
  • Read the docs: policies, observability, and the rest of the platform

​
Rolling Out to Your Team

Bringing a teammate onto Ultra is two decisions, and they are independent:
  1. How they join your organization, which sets their identity and role
  2. How their device connects, which puts it in a workspace
Mix and match freely. A beacon with no deploy key still signs in and links their own device. Someone invited as a Member can enroll with a deploy key and never sign in on the device at all.

​
Adding people to your organization

​
Directory sync

If you use Google Workspace, Okta, or another supported provider, SCIM directory sync provisions members automatically instead of adding them one at a time. Set the role new users receive under Settings > Security. Ultra does not email provisioned users; they sign in through SSO.

​
Invite

Use an invite when the person needs to sign in to Ultra and see data.
  1. Go to Settings > Invites
  2. Click Invite Member
  3. Enter the team member’s email address
  4. Select a role (Owner, Admin, Member, or Viewer). See Roles & Permissions for details
  5. Click Send Invite
The invited user receives an email with a link to join your organization. Accepting it settles their access. Connecting their device is the separate decision below.

​
Add a beacon

A beacon is a device-only membership. Their machine reports into Ultra; they get no dashboard access.
  1. Go to Settings > Members
  2. Click the + beside the Members heading and choose Add beacon
  3. Enter the person’s name and email
Adding a beacon creates their membership without sending them anything. To give them dashboard access later, switch their role from Beacon to Viewer, Member, or Admin using the dropdown on their row in the Members tab. They keep the device they already linked.

​
Connecting their devices

​
Browser sign-in

Every role can link its own device, Beacon included. They install Ultra, open their AI agent, and a browser sign-in appears on its own. Signing in is the whole job: the device links itself, and with one workspace there is nothing to choose. If you run several, the browser asks which one this device reports into. ultra login and ultra link do the same thing from the terminal, which is handy for re-linking a device or scripting a setup. Most people never need them.

​
Deploy key

A deploy key does the connecting for them. There is no sign-in and no workspace to pick: the key already names the workspace, and the device links itself the next time Ultra starts. Your teammate can enter the key while installing Ultra or any time after.
  1. Go to Settings > Security, find the Deploy Keys section, and click Create Deploy Key
  2. Give it a name, pick the workspace your team should report into, and choose an expiry
  3. Copy the key before closing the dialog
  4. Optionally, use the Connectors column to attach connectors to the key, so devices arrive with them already set up. See Pre-attaching connectors
  5. Share the key with your teammates through your usual secure channel, along with the install steps
One key covers everyone in that workspace, so you do not need a key per person. See Deploy Keys for every way a key can reach a machine.
Ultra never emails a deploy key, and the key is shown only once when you create it. Copy it before closing the dialog, because it cannot be retrieved afterward. If you lose it, revoke the key and create a new one.

​
MDM

For managed fleets, your MDM hands each device its deploy key. Enrollment is the deploy key path from there, minus every manual step: nobody is given a key, and nobody has to enter one. See the MDM Deployment Guide.

​
Attributing devices to people

The two decisions meet here. Linked devices match their owner’s identity to the people within your Ultra organization. No match yet? The device still links and works normally, showing as Unresolved Identity until that person is in your organization. Add them later and the device attributes itself, along with the activity it already recorded. Order does not matter: enroll machines first or add people first, and you land in the same place. Each linked device automatically syncs traces and audit events to Hub, providing team-wide visibility into MCP tool usage.

​
Organization Hierarchy