What a trusted domain does
A verified work domain does not give anyone a staff seat or a role in Studio. It can allow sign-in methods and Members agents for that domain.
Open Trusted domains, then Sign-in and access on the domain. See Verify a work domain for adding it and for the DNS check.
Nobody gets in by the domain alone
- The line under Trusted domains says Domain proof gives nobody a staff seat.
- Under Who can sign in, the page says People need an invitation or an existing staff account to open Studio. Signing in with this domain alone gives them no staff role.
- Right now says New people: no Studio access from the domain alone.
- A verified domain does not send an invitation, does not choose an access level, and does not add the person on People.
Who can sign in on this domain
These switches are for this domain. The company-wide ways in stay on Security. See How people sign in.
| Switch | Note |
|---|---|
| Allow people to sign in with their work Google account. The switch is Allow Google sign-in. | |
| Microsoft | Allow work Microsoft accounts from your organisation's tenant. The switch is Allow Microsoft sign-in. Then enter Microsoft tenant ID, the Directory (tenant) ID from Microsoft Entra. |
| Email code | Allow people to sign in using a code sent to their work email. The switch is Allow email-code sign-in. |
A tenant ID that is not 36 characters in five groups says Enter the tenant ID in the form 00000000-0000-0000-0000-000000000000. Save is available after something changed. The page says Sign-in settings saved for the domain. Discard drops the edit. Turning sign-in on before the proof is current says Check the current domain proof before enabling sign-in.
Members agents
- Members agents says Let people on this domain use Members agents after signing in. This gives nobody Studio access or a staff seat. The switch is People on this domain may use Members agents.
- Default for new agents is No domain default, Public — anyone, Members — people who sign in, or Private — people with Studio access. The help says Choose a default audience for new agents. Existing agents keep their own setting.
- Under the form: Current domain proof is required to enable access. Member sign-in must also be switched on in this environment. Saving Members agents does not by itself let people in when member sign-in is not switched on here.
- Right now may say Members agents configured on, Members agents configured off, Member access needs domain verification, or Member access paused.
Email names with a plus
5 Advanced: email matching holds Plus-tag matching. The note is Keep + as part of an email name if your company uses it in real mailbox names. Otherwise, +tags are ignored when matching a person. The switch is Our mailboxes use + in real names.