Skip to content

Docs

Single sign-on

Prove your company’s domains and require everyone with an address on them to sign in with Google or Microsoft, on Business.

On Business, admins can require everyone with a company address to sign in with Google or Microsoft, so access to the workspace goes through the accounts your company already manages.

1. Add your domains

Open Workspace settings → Security (admins only) and add the domains your addresses use, such as acme.com. A workspace can have up to 20; public email services such as gmail.com can’t be added.

2. Prove each domain

Each domain gets a TXT record. Add it at your DNS provider, on the domain itself:

newwork-verification=<token>

Then choose Check now. DNS changes can take a while to appear; if the record isn’t found yet, check again later.

3. Turn on the rule

With a verified domain, turn on the rule: people whose address is on a verified domain, or a subdomain of one, must sign in with Google or Microsoft. Before it goes on, the tab lists who it covers, who has never signed in with Google or Microsoft, and how many agent tokens will end.

To turn it on you must be signed in with Google or Microsoft yourself, so you can’t lock yourself out.

What changes for people

  • People it covers who signed in with a password or a magic link see “Acme signs in with Google or Microsoft”, with their workspace’s name and the sign-in buttons, instead of the workspace. They can still leave it.
  • People with addresses outside the domains, such as guests, sign in as before.
  • The database enforces the rule on every request, for the app, the API and MCP alike.

Agent tokens

Turning the rule on, or verifying another domain while it is on, ends the agent tokens of the people it newly covers. They create new ones under Workspace settings → Agents & MCP while signed in with Google or Microsoft; a new token needs such a session.

Turning it off

An admin outside the domains can turn the rule off. Removing the last verified domain turns it off too. If no admin can sign in any more, write to support and we turn it off for you. Domains and every change to the rule are entries in the audit log.

SAML and SCIM are not part of Business; they come with Enterprise agreements.