diff --git a/doc/subscriptions/gitlab_com/index.md b/doc/subscriptions/gitlab_com/index.md index 092b0dd0077d1f92759ee416082855daa91d4017..bf4c3231ac0e8477716976903225f507fe1e498d 100644 --- a/doc/subscriptions/gitlab_com/index.md +++ b/doc/subscriptions/gitlab_com/index.md @@ -78,7 +78,7 @@ A top-level group can be [changed](../../user/group/manage.md#change-a-groups-pa Every user is included in seat usage, with the following exceptions: - Users who are pending approval. -- Members with the Guest role on an Ultimate subscription. +- Members with the [Guest role on an Ultimate subscription](#free-guest-users). - GitLab-created service accounts: - [Ghost User](../../user/profile/account/delete_account.md#associated-records). - Bots such as: @@ -160,6 +160,16 @@ For example, if you purchase a subscription for 10 users: Seats owed = 12 - 10 (Maximum users - users in subscription) +### Free Guest users **(ULTIMATE)** + +In the **Ultimate** tier, users who are assigned the Guest role do not consume a seat. +The user must not be assigned any other role, anywhere in the instance. + +- If your project is private or internal, a user with the Guest role has + [a set of permissions](../../user/permissions.md#project-members-permissions). +- If your project is public, all users, including those with the Guest role + can access your project. + ### Add users to your subscription Your subscription cost is based on the maximum number of seats you use during the billing period. diff --git a/doc/subscriptions/self_managed/index.md b/doc/subscriptions/self_managed/index.md index c4110fe46384c5024b413ab30dd47ea64c83ca73..8dcec9263ccce5ff6928c1c71e5c493b342e33f9 100644 --- a/doc/subscriptions/self_managed/index.md +++ b/doc/subscriptions/self_managed/index.md @@ -63,7 +63,7 @@ billable user, with the following exceptions: [blocked users](../../user/admin_area/moderate_users.md#block-a-user) don't count as billable users in the current subscription. When they are either deactivated or blocked they release a _billable user_ seat. However, they may count toward overages in the subscribed seat count. - Users who are [pending approval](../../user/admin_area/moderate_users.md#users-pending-approval). -- Members with the Guest role on an Ultimate subscription. +- Members with the [Guest role on an Ultimate subscription](#free-guest-users). - Users without project or group memberships on an Ultimate subscription. - GitLab-created service accounts: - [Ghost User](../../user/profile/account/delete_account.md#associated-records). @@ -97,6 +97,21 @@ If you add more users to your GitLab instance than you are licensed for, payment If you do not add these users during the renewal process, your license key will not work. +#### Free Guest users **(ULTIMATE)** + +In the **Ultimate** tier, users who are assigned the Guest role do not consume a seat. +The user must not be assigned any other role, anywhere in the instance. + +- If your project is private or internal, a user with the Guest role has + [a set of permissions](../../user/permissions.md#project-members-permissions). +- If your project is public, all users, including those with the Guest role + can access your project. + +NOTE: +If a user creates a project, they are assigned the Maintainer or Owner role. +To prevent a user from creating projects, as an administrator, you can mark the user +as [external](../../user/permissions.md#external-users). + ### Tips for managing users and subscription seats Managing the number of users against the number of subscription seats can be a challenge: diff --git a/doc/user/permissions.md b/doc/user/permissions.md index ea4d1e374fbeff8e8da66a055b05ddabbd310b5c..0d13ad1a1a18cad9c13ec11ea7181a995df459c4 100644 --- a/doc/user/permissions.md +++ b/doc/user/permissions.md @@ -12,9 +12,6 @@ The role determines which actions they can take in GitLab. If you add a user to both a project's group and the project itself, the higher role is used. -On [public and internal projects](../api/projects.md#project-visibility-level), the Guest role -(not to be confused with [Guest user](#free-guest-users)) is not enforced. - When a member leaves a team's project, all the assigned [issues](project/issues/index.md) and [merge requests](project/merge_requests/index.md) are automatically unassigned. @@ -27,7 +24,7 @@ To add or import a user, you can follow the The available roles are: -- Guest +- Guest (This role applies to [private and internal projects](../user/public_access.md) only.) - Reporter - Developer - Maintainer @@ -548,27 +545,6 @@ WARNING: Be aware that this regex could lead to a [regular expression denial of service (ReDoS) attack](https://en.wikipedia.org/wiki/ReDoS). -## Free Guest users **(ULTIMATE)** - -When a user is given the Guest role on a project, group, or both, and holds no -higher permission level on any other project or group on the GitLab instance, -the user is considered a guest user by GitLab and does not consume a license seat. -There is no other specific "guest" designation for newly created users. - -If the user is assigned a higher role on any projects or groups, the user -takes a license seat. If a user creates a project, the user becomes a Maintainer -on the project, resulting in the use of a license seat. Also, note that if your -project is internal or private, Guest users have all the abilities that are -mentioned in the [permissions table above](#project-members-permissions) (they -are unable to browse the project's repository, for example). - -NOTE: -To prevent a guest user from creating projects, as an administrator, you can edit the -user's profile to mark the user as [external](#external-users). -Beware though that even if a user is external, if they already have Reporter or -higher permissions in any project or group, they are **not** counted as a -free guest user. - ## Auditor users **(PREMIUM SELF)** Auditor users are given read-only access to all projects, groups, and other