Approve requests to join your organization

Control whether people with an email address on your verified domain can request to join your organization, and decide each request yourself.

Overview

• When someone signs in with an email address on one of your verified domains, you can choose to let them ask to join.
• An administrator always makes the final call — nobody is added automatically.
• A matching domain only proves an email address, not who someone is or what access they should have. Contractors, former staff, and shared mailboxes can all share your domain, and members can see every domain, DNS record, server and monitor in your organization. That's why a domain match starts a request instead of granting access.

Choose what a sign-in does

1. Go to Settings → Sign-in.
2. Find the sign-in connection you want to configure.
3. Under When someone signs in with a verified domain, choose one of:
   • Do nothing — the person will need an invitation to join. This is the default.
   • Ask an admin — the person can request to join, and an administrator decides.
4. Anyone waiting on a decision appears under Requests to join on the same page. Administrators also get a notification. This section only shows up when someone is actually waiting.

Approve or deny a request

1. Go to Settings → Sign-in and find the Requests to join section.
2. Review each request — you'll see who asked and when.
3. Choose Approve to add the person as a member with the connection's default role, or Deny to turn them away.

NoteDenying a request stands until you invite the person yourself — signing in again won't put them back in your queue.

4. If you approved someone, and you want to give them more access, go to Settings → Members and raise their role individually.

TipNew members always start on a role without write or management permissions. It's easier to grant more access later than to discover someone had too much all along.

Troubleshooting

Out of seats? Requests still come in even when your plan is full — you just can't approve one until a seat frees up. Trying anyway will tell you the member limit is reached, but the request stays in the queue so you can decide later, or free up a seat and come back to it.

What the person sees: They sign in successfully and keep any access they already had — they just aren't part of your organization until you approve. If they didn't have an account before, they get their own personal organization in the meantime, so they're never left with nothing.