Single Sign-On (SSO) SAML: Configure one or more email domains for your studio

• Introduction
• Requirements
• Add a domain
• Verify a domain
• Choose how users sign in
  • Before you require single sign-on
  • If single sign-on becomes unavailable
• Remove a domain

#Introduction

The Email domains page lets your studio prove that it owns the domains your users have email addresses on, such as acmecorp.com. Once a domain is verified, you can choose how everyone with an address on that domain signs in to Managed Studio.

Verifying a domain also lets Managed Studio recognise your users on the sign in page and send them straight to your identity provider. For more information please see Single Sign-On (SSO) SAML: Signing in.

#Requirements

• Permission to manage studio settings
• Access to the DNS settings for each domain you want to add
• A plan that includes SAML single sign-on
• A SAML identity provider configured on the Single sign-on (SAML) page. You can add and verify domains before this, but you will not be able to turn on single sign-on for them until a provider is configured. See Google or Microsoft Entra ID for setup instructions.

#Add a domain

To add a domain:

1. Navigate to the Settings page
2. Click Email domains
3. Click Add domain
4. Enter the domain your users have email addresses on, such as acmecorp.com
5. Click Add domain

The domain is added with a Pending verification badge.

#Verify a domain

Each pending domain shows a DNS TXT record that proves your studio controls the domain.

To verify a domain:

1. Copy the Name and Value shown under Verify this domain
2. In your DNS provider, create a TXT record using those values
3. Return to the Email domains page
4. Click Check DNS record

When the record is found, the badge changes to Verified.

The Name is _managed-studio-challenge, which some DNS providers expect on its own and others expect as the full host name, such as _managed-studio-challenge.acmecorp.com. Because the record sits on its own name, it will not conflict with SPF or any other TXT records on your domain.

#Choose how users sign in

Once a domain is verified, a Single sign-on section appears beneath it with three options:

• Disabled: users sign in with any available method. This is the default for new domains.
• Optional: users are offered Continue with SSO on the sign in page, alongside their password.
• Required: users must sign in with single sign-on. Password sign in and password resets are turned off for every address on the domain.

To change how users on a domain sign in:

1. Navigate to the Settings page
2. Click Email domains
3. Choose Disabled, Optional or Required for the domain
4. Click Save changes

#Before you require single sign-on

Required only becomes available after someone has successfully signed in through your SAML identity provider at least once. This protects your studio from a misconfigured provider locking everyone out.

We recommend setting the domain to Optional first, signing in with single sign-on yourself to confirm everything works, then switching to Required.

#If single sign-on becomes unavailable

If you remove your SAML identity provider, or your plan no longer includes SAML single sign-on, your domains stop offering single sign-on and users go back to signing in with their passwords. Your domain settings are kept, so they apply again once single sign-on is available.

#Remove a domain

To remove a domain:

1. Navigate to the Settings page
2. Click Email domains
3. Open the domain context menu
4. Click Remove domain
5. Type delete in the confirmation field
6. Click Remove domain

Once removed, your studio is no longer treated as the owner of addresses on that domain. You will need to verify the domain again to get that back.

Adding, verifying, removing and changing the single sign-on setting for a domain are all recorded in the Audit logs.