Skip to main content
Organization admins manage company email domains in Settings → Organization → Domains. Domain verification establishes the company’s domain; the join policy separately decides whether a person may become a member.

​
Add and verify a domain

  1. Open Domains and select Add domain.
  2. Enter the email domain. Choose Verify it as a company domain for SSO and automatic joining, or Allow invitations only for an invitation allowlist entry.
  3. For a company domain, select Continue to verification and add the DNS record shown in hosted setup. For an allowlist entry, select Add to allowlist; this does not verify ownership or open a verification portal.
  4. Return to Domains and check that the company domain is Verified. Use Check again if verification is pending, or Resume verification to return to hosted setup.
A pending domain does not satisfy the verified-domain requirement for company SSO. Domains used for company ownership and domains allowed for invitation have different roles; review the kind shown on each row. This example has a verified company domain but still requires an invitation to join. Verification makes a domain eligible for SSO and domain-based joining; it does not select either joining policy by itself. Domains showing northstar.example as verified, invitation-only joining, and the Only invite company addresses control

​
Choose who may join

The join-policy control offers: Select Save after changing the policy, then confirm the saved selection. Review pending invitations and requests in Members. Changing a join policy does not remove existing members. Only invite company addresses restricts invitations to verified company domains and invitation allowlist entries. It turns on when a company domain is first verified. Review this control separately from who can join.

​
Remove a domain

Before removing a verified company domain, review Authentication. Removing it stops domain-based joining for its addresses and can leave SSO without a verified company domain. Configure another verified domain or change the sign-in policy first when the organization still needs that sign-in path. Open the domain’s action menu, select Remove, and confirm with Remove domain. Verify the domain list and sign-in readiness afterwards. Removing an invitation allowlist entry also stops its addresses matching Only invite company addresses.