When Organization is configured with identity domain, the user id (email) (-u option) in the import tool cli should be sent with the identity domain before the user email (e.g. email@example.com).
If it will send without the identified domain the user will get unauthorized error.
Example for import tool cli command in this case:
./ravello import-disk -firstname.lastname@example.org --disk disk.iso
This is relevant also when configuring user in the training portal and the organization had identity domain.