Networks and members

Networks

A network is a private group of devices that can reach each other. Each network has:

• a name and a 10-character network ID, such as k3x9q2m7pa. The CLI uses the ID.
• a subnet that device addresses come from. New networks use 100.100.0.0/16.
• one access policy with its rules, groups, tests and shadowing rules.
• members: the people who belong to it, each with a role.
• devices that have joined it.
• its own settings, audit log and plan.

Networks are fully separate. A rule in one network can't refer to devices in another.

How you get networks

• Your first sign-in creates one. When you first sign in, whichever method you use (GitHub, Google, Microsoft, Apple or your own identity provider), Peerlify creates a network named after you (for example "Alice's Network", or "Personal Network" if the provider doesn't supply your name), with you as its Owner.
• GitHub organizations. Signing in with GitHub also adds you to the network of each GitHub organization you are an active member of, once that network exists. Only an organization owner (an admin of the organization on GitHub) creates it, by signing in, and becomes its Owner. Other organization owners who sign in later join as Admin, and members join as Member; a member who signs in before it exists gets only their own network, and joins at their next sign-in after an organization owner has created it. A network for an organization that has no Owner, for example one made earlier by a member's sign-in, gets as its Owner the first organization owner who signs in. People outside the organization can still join through an invite. If you leave the organization, your next GitHub sign-in removes you from its network, once GitHub confirms you left; access you got through an invite stays (see Remove a device or a person). A network Peerlify creates now belongs to the organization itself, not to its name: renaming the organization on GitHub keeps its network, members and devices, and another organization that later takes the old name never gets into it. A network Peerlify made for an organization before it tracked organizations this way is still known only by the organization's name. It is linked to the organization at the next GitHub sign-in of its Owner. A network like that with no Owner is never linked by a sign-in: contact Peerlify support, who link it to your organization once you've shown it's yours. Until it is linked, its members keep their access, nobody joins it automatically, and no second network is made for that organization. An organization created on GitHub after that network was made can't be the one it was made for, so it is never linked to it; that organization gets a network of its own instead. However it was linked, by its Owner's sign-in or by Peerlify support, someone who joins it after the link can be an Admin of it but never becomes its Owner: if it has no Owner, only an organization owner who was already in it before the link can become one. If the organization was renamed before that happened, its old network isn't linked automatically: its members keep it, and an Owner or Admin can invite the others.
• Microsoft work and school accounts. Your organization's Microsoft Entra tenant has one network, found by the tenant, never by your email address. Only an Entra administrator of the tenant (Global Administrator, Application Administrator or Cloud Application Administrator) creates it, by signing in, and becomes its Owner. Other people from the tenant join it as Member when they sign in once it exists, and Entra administrators who sign in later join as Admin; before it exists they get only their own network. Guests in the tenant and personal Microsoft accounts, such as outlook.com addresses, never join it. If you signed in with Microsoft before Peerlify created networks for Microsoft accounts and you already made one yourself, that one stays yours and no second one is added.
• Networks from earlier Microsoft sign-ins. Peerlify used to group Microsoft accounts by email domain, for example example.com. Such a network becomes the tenant's network the first time someone signs in from the tenant that has verified that domain in Entra; it keeps its ID, devices, rules, plan and members. If its Owner belongs to another tenant, or no longer signs in with Microsoft, they stay a Member and the network has no Owner until an Entra administrator of the tenant signs in. An Owner whose tenant Peerlify doesn't know yet stays Owner until it is confirmed. Their own next Microsoft sign-in confirms it; a colleague's sign-in decides it only once the Owner's tenant is on record. Until then, an Entra administrator of the tenant who signs in takes ownership, and the previous Owner stays a Member. These changes appear in the audit log. A network that no tenant takes over stays as it is, and nobody joins it by email domain any more.
• Google Workspace accounts. If you sign in with a Google Workspace account whose email address Google has verified, Peerlify adds you to your Workspace's network, found by the Workspace domain. The first person from the Workspace to sign in creates it and becomes its Owner; colleagues who sign in later join as Member (or wait for approval if Manual user approval is on). If the network ever has no Owner, a later sign-in never makes anyone its Owner. Personal Google accounts, such as gmail.com addresses, get only their own network. The Workspace network never claims your domain for single sign-on or domain discovery.
• Your company's single sign-on. If your company registered its own identity provider (see Connect your OIDC provider), signing in through it adds you to the company's network, when your provider has verified your email address and the address is at the domain the provider was registered for. The first such person to sign in becomes its Owner; everyone after that joins as Member, or waits for approval if Manual user approval is on. Guests and accounts at other domains in your provider get only their own network. A network that has no Owner but already has members isn't handed to whoever signs in next. If your single sign-on was registered before this change, its network gets its Owner the same way: the first such person from your domain to sign in after it.
• You create one. In the console, open the network switcher in the header and choose Create network. Give it a name; you become its Owner. You can change its subnet later in Network settings.
• Someone invites you. See Invite people.

You can belong to any number of networks. Switch between them with the network switcher in the console, or move a device with peerlify network swap. See Create and switch networks.

Members and roles

A member is a person in a network. The same person can be the Owner of one network and a Member of another; roles belong to the membership, not to the person.

IT admin, Network admin, Billing admin and Auditor can only be assigned on Business and Enterprise plans. See Members and roles for the exact permissions.

Some networks hold new members for approval: see Manual user approval.

Devices in a network

A device joins a network when someone signs it in. It gets an address and a name in that network, and the network's rules decide what it can reach. A device can have joined several networks, but it is active in only one at a time.

Each device is either owned by a person (the one who signed it in) or, if it has tags, a shared resource owned by its tags. See Devices.

Next steps

• Devices
• Members and roles
• Invite people