WORKSPACES AND TEAMS · SIGN-IN

Set up company domains and SSO

Verify the email domains your organization uses. Then choose whether to enable automatic enrollment or let members sign in through your identity provider.

What you need

You need organization administration access and permission to change your domain’s DNS records. For single sign-on, you also need permission to create an OpenID Connect application in your identity provider.

Domain verification, automatic enrollment, and SSO are separate settings. Verify the domain first. Enable the other options only when they match how your team should join and sign in.

Verify a domain

1. Open your organization’s Admin area and choose Domain & sign-in.
2. Enter your company’s email domain under Email domain, then choose Add domain.
3. Start DNS verification. Copy the exact TXT record name and value shown.
4. Add the record at your DNS provider.
5. Return to PersonaStack and choose Check DNS record.

Wait for Verified by DNS. If the record is not found, check the spelling and allow time for the change to become visible. Verify each domain separately. Keep the record in place if you use automatic enrollment.

Choose automatic enrollment

Domain auto-enrollment lets people join the organization when their email matches a domain with current DNS verification. Pending domains cannot enroll people. Review this setting before enabling it for a domain used by contractors or other groups.

After people join, review their workspace access in Members.

Connect an identity provider

1. Choose Manage organization SSO.
2. Create an OIDC Web Application at your identity provider. Copy the sign-in redirect URI from PersonaStack into that application.
3. Enable Authorization Code and assign the application to the intended team. Follow the identity provider’s setup instructions.
4. Enter the exact Issuer URL, Client ID, and Client secret in PersonaStack.
5. Choose Save configuration.
6. Use Test sign-in with an eligible account from a verified domain. After the test succeeds, choose Enable SSO.

The test checks sign-in without creating an account or membership. One identity provider serves the organization’s verified domains. Keep client secrets in the configuration form. Do not paste them into team messages or support screenshots.

Change or disable SSO

Saving changes disables SSO until the new configuration passes its test. Existing sessions stay signed in. Before disabling or removing SSO, review the number of members who rely on it and ask them to add a password in Profile if needed.

Disabling SSO stops new organization SSO sign-ins. It does not sign out every existing session. Review access separately when removing a member.

Need a hand? Contact the PersonaStack team.