> Index of every Falcon docs page, for assistants: https://falcon.com/docs/llms.txt

# What a trusted domain does

A verified work domain does not give anyone a staff seat or a role in Studio. It can allow sign-in methods and Members agents for that domain.

Open **Trusted domains**, then **Sign-in and access** on the domain. See [Verify a work domain](https://falcon.com/docs/verify-a-domain) for adding it and for the DNS check.

## Nobody gets in by the domain alone

- The line under **Trusted domains** says **Domain proof gives nobody a staff seat.**
- Under **Who can sign in**, the page says **People need an invitation or an existing staff account to open Studio. Signing in with this domain alone gives them no staff role.**
- **Right now** says **New people: no Studio access from the domain alone.**
- A verified domain does not send an invitation, does not choose an access level, and does not add the person on **People**.

## Who can sign in on this domain

These switches are for this domain. The company-wide ways in stay on **Security**. See [How people sign in](https://falcon.com/docs/sign-in-methods).

| Switch | Note |
|---|---|
| Google | Allow people to sign in with their work Google account. The switch is Allow Google sign-in. |
| Microsoft | Allow work Microsoft accounts from your organisation's tenant. The switch is Allow Microsoft sign-in. Then enter Microsoft tenant ID, the Directory (tenant) ID from Microsoft Entra. |
| Email code | Allow people to sign in using a code sent to their work email. The switch is Allow email-code sign-in. |

A tenant ID that is not 36 characters in five groups says **Enter the tenant ID in the form 00000000-0000-0000-0000-000000000000.** **Save** is available after something changed. The page says **Sign-in settings saved for** the domain. **Discard** drops the edit. Turning sign-in on before the proof is current says **Check the current domain proof before enabling sign-in.**

## Members agents

- **Members agents** says **Let people on this domain use Members agents after signing in. This gives nobody Studio access or a staff seat.** The switch is **People on this domain may use Members agents**.
- **Default for new agents** is **No domain default**, **Public — anyone**, **Members — people who sign in**, or **Private — people with Studio access**. The help says **Choose a default audience for new agents. Existing agents keep their own setting.**
- Under the form: **Current domain proof is required to enable access. Member sign-in must also be switched on in this environment.** Saving **Members agents** does not by itself let people in when member sign-in is not switched on here.
- **Right now** may say **Members agents configured on**, **Members agents configured off**, **Member access needs domain verification**, or **Member access paused**.

## Email names with a plus

**5 Advanced: email matching** holds **Plus-tag matching**. The note is **Keep + as part of an email name if your company uses it in real mailbox names. Otherwise, +tags are ignored when matching a person.** The switch is **Our mailboxes use + in real names**.

## Related

- [How people sign in](https://falcon.com/docs/sign-in-methods)
- [Sign in with Microsoft](https://falcon.com/docs/microsoft-sign-in)
- [Require a second step](https://falcon.com/docs/require-a-second-step)
- [Verify a work domain](https://falcon.com/docs/verify-a-domain)
- [Access levels](https://falcon.com/docs/people-access-levels)
- [Company settings](https://falcon.com/docs/company-settings)