Managing Authorities for SSO Domain Access

bhavik.patel@oneadvanced.com Updated by bhavik.patel@oneadvanced.com

Authorities

Authorities are used to control which email domains are allowed to authenticate, pair, or create user accounts

When Automatic Pairing is enabled as part of the First Login Flow, Authorities act as a security control to ensure that only users from approved domains can login even if their user account does not yet exist.

Configuring an Authority

Authorities are managed from the Authorities tab within the Organisation settings.

To add an Authority:

  1. Navigate to Organisation → Authorities
  2. Select Add Authority
  3. Enter the domain that users are expected to log in with
    (for example: example.com)
  4. Save the Authority

You can add multiple domains if users may authenticate using different email addresses.

Authority Validation (DNS Verification)

After an Authority is created, it must be validated before it can be used.

When you add a domain, you will see the following message:

Authority needs validation The authority has now been created. To enable the authority, add a text record to the DNS record of domain <domain>

TXT record: ssoauthority-verification=<value>

Once this has been done, return here and validate the authority.

This step confirms ownership of the domain and prevents unauthorised domains from being used.

An Authority can also be validated manually by an administrator. After successful validation, the Authority becomes active and users with matching email domains will be allowed to authenticate based on the configured First Login Flow.

How did we do?

How to add or replace an x509 certificate for Azure Active Directory federations

Contact