diff --git a/public/docs-static/img/manage/team/sign-in-domains/authentication-tab.png b/public/docs-static/img/manage/team/sign-in-domains/authentication-tab.png new file mode 100644 index 00000000..1c66d733 Binary files /dev/null and b/public/docs-static/img/manage/team/sign-in-domains/authentication-tab.png differ diff --git a/public/docs-static/img/manage/team/sign-in-domains/dns-verification.png b/public/docs-static/img/manage/team/sign-in-domains/dns-verification.png new file mode 100644 index 00000000..f1790c74 Binary files /dev/null and b/public/docs-static/img/manage/team/sign-in-domains/dns-verification.png differ diff --git a/public/docs-static/img/manage/team/sign-in-domains/login.png b/public/docs-static/img/manage/team/sign-in-domains/login.png new file mode 100644 index 00000000..f39c1c5d Binary files /dev/null and b/public/docs-static/img/manage/team/sign-in-domains/login.png differ diff --git a/src/components/NavigationDocs.jsx b/src/components/NavigationDocs.jsx index 01ff0d21..aabb2bdb 100644 --- a/src/components/NavigationDocs.jsx +++ b/src/components/NavigationDocs.jsx @@ -373,6 +373,10 @@ export const docsNavigation = [ // { title: 'JumpCloud', href: '/manage/team/single-sign-on/jumpcloud' }, // ] }, + { + title: 'Sign-in Domains', + href: '/manage/team/sign-in-domains', + }, ], }, { diff --git a/src/pages/manage/team/sign-in-domains.mdx b/src/pages/manage/team/sign-in-domains.mdx new file mode 100644 index 00000000..66580030 --- /dev/null +++ b/src/pages/manage/team/sign-in-domains.mdx @@ -0,0 +1,85 @@ +import {Note, Warning} from "@/components/mdx" + +export const description = + 'Users on your business email domain join your account automatically. Add and verify the other domains your business uses, so their users join the same account instead of creating one of their own.' + +# Allow Users from Other Domains to Join Your Account + +By default, users who sign in with the same business email domain as yours join the same account. +For example, everyone on `@company.com` lands in your network, with the same peers and policies. + +In most cases a business uses more than one domain: a country domain like `company.co.uk`, a subsidiary like `company-berlin.de`, or a second brand. +A colleague signing in as `jane@company.co.uk` is not recognized as yours unless you [invite them manually](/manage/team/add-users-to-your-network), so they +get an account of their own. + +**Sign-in domains** allow users from other domains to join your account without manually inviting them beforehand. +You prove ownership of those domains, and everyone across your organization joins the same account automatically. + + + **Availability**: Sign-in Domains is only available on NetBird Cloud. + + + **Permissions**: Only an Owner or Admin can manage sign-in domains. Learn more about [user roles](/manage/team/user-roles). + + + + Verifying a domain does not move users who already have an account of their own. It decides where **new** users land, so add your domains before onboarding a team from another domain rather than after. + + If someone turns out to have an earlier account they were not aware of, have them reach out to [NetBird Support](/help/netbird-support). The team verifies their identity and points them to whoever administers that account. + + +## Add Domain + +Go to **Settings → Authentication**, find **Sign-in Domains**, then click **Add** and enter the domain, e.g. `company.co.uk`. + +

+ The Sign-in Domains section of the Authentication tab, listing the account's domains with their verification status +

+ +The domain starts as **Pending** until you prove you own it. + +## Verify Domain + +Click **Verify** on the pending domain. NetBird shows a TXT record to publish at the root of the domain, so on `company.co.uk` itself rather than `www.company.co.uk`. + +

+ The verification dialog showing the TXT record name and value to publish in DNS +

+ +Add the record, then click **Start Verification**. NetBird keeps checking on its own, so you can leave the page. The domain becomes **Verified** once the record is found. If it never appears the domain ends up **Unverified**, and **Verify** starts the checks again. + +If you cannot change DNS, contact [NetBird Support](/help/netbird-support) from an email address on the domain instead, and the team will verify it for you. + + + A domain can only be verified by one account. If another account already holds it, your checks keep failing — contact [NetBird Support](/help/netbird-support). + + +Once the domain is Verified, a user signing in for the first time with an address on it joins your account. + +

+ The NetBird login page, where a user signing in with an email address on a verified domain joins the existing account +

+ +## Remove Domain + +Click the delete icon on the domain's row. The domain you signed up with cannot be removed, and neither can a domain an SSO integration still uses. + +Removing a domain does not remove or lock out users who already joined through it. It only stops matching new sign-ins, who get accounts of their own again. + +## Recap + +- A sign-in domain tells NetBird that an email domain belongs to your account, so new users join your network instead of creating one of their own. +- Your signup domain is there from the start and cannot be removed; add and verify any others yourself. +- Verification is a TXT record at the root of the domain, re-checked automatically until it is found. +- It changes where new users land, not where existing ones already are. + +## Related Docs + +- [Authenticate to NetBird with Single Sign-On](/manage/team/single-sign-on) +- [Add users to your network](/manage/team/add-users-to-your-network) +- [User roles](/manage/team/user-roles) +- [Approve users](/manage/team/approve-users) +- [Provision users and groups from your IdP](/manage/team/idp-sync)