> ## Documentation Index
> Fetch the complete documentation index at: https://platform.atlan.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> To act on Atlan objects, use the Atlan MCP server at https://api.atlan.com/mcp or the SDK. To install or publish skills from a terminal, use the `aireg` CLI; `aireg --map json` prints its command map. The `atlanai` CLI is deprecated. Run a read-only identity check before any write.
> The docs MCP server at /mcp searches these docs only. It cannot read or change Atlan objects.
> SDK packages: Python `atlanai` (PyPI) and TypeScript `@atlanai/sdk` (npm). Show Python first, then TypeScript.
> These docs cover Atlan AI Registry, Atlan's hosted product. The AI registry specification and aireg CLI are maintained separately. /open-source lists publicly reachable signed installers and explains that the source repository and hosted CLI reference currently require GitHub access. Do not claim the repository or its reference docs are publicly accessible. Use these docs for Atlan-specific setup such as the adapter, sign-in and workspaces.

# Manage company domains

> Verify company email domains and choose how people join your organization.

Organization admins manage company email domains in **Settings → Organization →
Domains**. Domain verification establishes the company's domain; the join policy
separately decides whether a person may become a member.

## Add and verify a domain

1. Open **Domains** and select **Add domain**.
2. Enter the email domain. Choose **Verify it as a company domain** for SSO and
   automatic joining, or **Allow invitations only** for an invitation allowlist
   entry.
3. For a company domain, select **Continue to verification** and add the DNS
   record shown in hosted setup. For an allowlist entry, select **Add to
   allowlist**; this does not verify ownership or open a verification portal.
4. Return to **Domains** and check that the company domain is **Verified**. Use
   **Check again** if verification is pending, or **Resume verification** to
   return to hosted setup.

A pending domain does not satisfy the verified-domain requirement for company
SSO. Domains used for company ownership and domains allowed for invitation have
different roles; review the kind shown on each row.

This example has a verified company domain but still requires an invitation to
join. Verification makes a domain eligible for SSO and domain-based joining; it
does not select either joining policy by itself.

<img src="https://mintcdn.com/atlan-602e2b74/IySoseVxu4BPYuCl/assets/screenshots/composed/admin-domains.png?fit=max&auto=format&n=IySoseVxu4BPYuCl&q=85&s=fd2487861043ace2a5e26c1900910115" alt="Domains showing northstar.example as verified, invitation-only joining, and the Only invite company addresses control" width="2400" height="1600" data-path="assets/screenshots/composed/admin-domains.png" />

## Choose who may join

The join-policy control offers:

| Policy | Result |
| - | - |
| **By invitation only** | Each person needs an invitation. |
| **Anyone with a verified company email joins automatically** | A person signing in with an address at a verified domain becomes a member. |
| **Anyone with a verified company email can request to join** | The request waits for an admin's approval in Members. |
| **Closed** | Nobody joins, including by invitation. |

Select **Save** after changing the policy, then confirm the saved selection.
Review pending invitations and requests in [Members](/administer/users/index).
Changing a join policy does not remove existing members.

**Only invite company addresses** restricts invitations to verified company
domains and invitation allowlist entries. It turns on when a company domain is
first verified. Review this control separately from who can join.

## Remove a domain

Before removing a verified company domain, review [Authentication](/admin/security/how-tos/configure-sso).
Removing it stops domain-based joining for its addresses and can leave SSO
without a verified company domain. Configure another verified domain or change
the sign-in policy first when the organization still needs that sign-in path.

Open the domain's action menu, select **Remove**, and confirm with **Remove
domain**. Verify the domain list and sign-in readiness afterwards. Removing an
invitation allowlist entry also stops its addresses matching **Only invite
company addresses**.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.