SSO & Domains
Manage company domains, SSO, member admission, access requests, and account security settings.
Open SSO & Domains in Settings. The Account Owner and Administrators can manage these controls. SSO requires Enterprise; domain verification and native automatic joining do not require an SSO connection.
Overview and getting started
Overview shows your verified domain, how people join, and seats in use. Manage domains, Manage joining, and View users open the relevant controls. Pending invitations occupy seats; revoked members and pending access requests do not.
Use Getting started to follow setup progress. For the complete procedure, see Manage single sign-on.
Company domain
Enter a company email domain such as example.com, without an email address or website URL, and select Add domain. Each domain can belong to only one GovTribe account. Use Verify domain to follow WorkOS's verification instructions, then return and refresh the page.
After verification, Let coworkers find this account offers your account to people signing up with that email domain. The switch saves automatically. Discovery alone does not grant access; How people join controls admission.
Remove releases the domain claim and its verification. You cannot remove the last verified domain while required SSO or Block separate accounts is on. With automatic joining on, you also cannot remove or hide the last verified domain that coworkers can discover. Choose Invite only first. Email invitations do not require domain verification.
Single sign-on
Accounts without SSO show the Enterprise offer and Contact sales. Eligible accounts can use the following controls after adding a domain.
| Control | What it does |
|---|---|
| Set up SSO / Edit setup | Opens WorkOS to connect or update your identity provider. |
| Refresh status | Checks the connection and domain verification again. Connection status is Connected, Not connected, or Status unavailable. |
| Test sign-in | Starts an administrator sign-in through the identity provider. |
| Require single sign-on | Requires company sign-in for every member. The switch saves automatically and starts Off. |
Before requiring SSO, verify a domain, connect the provider, and complete an administrator SSO sign-in test. A successful member sign-in alone does not satisfy the administrator test. If the provider status is unavailable, refresh it before changing the requirement.
Turning required SSO on signs password users out on their next request. Turning it off allows existing GovTribe passwords again; it does not create passwords for people who joined only through SSO.
How people join
| Choice | How new people join |
|---|---|
| Invite only | An administrator invites each person from Users. Uninvited people cannot join or submit access requests. This is the initial choice. |
| Join automatically | People with a verified, discoverable company domain can join when a seat is open. GovTribe verifies their email and phone for native joining, or their identity through SSO. |
Automatic joining is also called just-in-time provisioning, or JIT. It requires a verified domain with Let coworkers find this account on. SSO is needed only when the account requires it. Admission choices save automatically.
When a verified applicant cannot join because the account is full, account managers receive an access-request email. Use Review on Users, or open Users, to review Waiting to join.
You can approve a request before a seat is available. Approval emails a sign-in link but does not reserve or buy a seat. The next sign-in checks capacity and the current joining and SSO settings. Dismiss closes the request without emailing the person; a later qualifying sign-in can reopen it. Cancel approval withdraws an approval that has not yet been used.
Security
| Setting | What it controls |
|---|---|
| Block separate accounts | Prevents new people on your verified domains from creating separate GovTribe accounts or trials. Requires a verified domain, starts Off, and saves automatically. |
| Stay signed in for | GovTribe default preserves normal password sign-in and Remember me behavior; SSO sign-ins expire after 14 days. Choosing 1, 7, or 14 days applies that period to all members. Saves automatically. |
Sessions can end sooner after inactivity. Choosing a period can require a fresh sign-in for a remembered password session without an original sign-in time. These settings do not change API key expiration.
Blocking separate accounts applies to verified domains even when coworkers cannot discover the account. It does not move existing users from other accounts, enable automatic joining, or turn on SSO. New people still need a permitted join option or invitation.
Related articles
- Manage single sign-on: Set up and test your identity provider and choose how people join.
- Users: Review seats, invitations, and people waiting to join.
- My profile: Understand personal settings when using SSO.
- Troubleshoot GovTribe account access: Resolve verification and sign-in problems.