Skip to main content
SSO applies to people by email domain, so each domain must be verified before its people can use your connection. You need to be an owner or admin, and able to add a DNS record for the domain.

​
Claim a domain

1

​
Open Claim domain

Go to Settings > Single sign-on and, under Domains, choose Claim domain.
2

​
Claim the domain

Enter the domain, such as example.com, and choose Claim. The domain appears in the list with a Pending status, its TXT record open under the row.
Matching is exact: example.com doesn’t cover eu.example.com, so claim each subdomain your people’s addresses use. Shared email domains, such as gmail.com, can’t be claimed. Several organizations can hold a pending claim on the same domain; the first to verify it holds it, and no other organization can verify it after that. To manage domains with Terraform, use sazabi_sso_domain and sazabi_sso_domain_verification.

​
Publish the TXT record

Add this record at your DNS provider. Copy the name and value from the domain’s row (choose Record to show them), or from the CLI’s output; the value is unique to your claim. Leave the record in place after the domain is verified.

​
Keep the domain verified

Sazabi keeps checking verified domains:
  • A lookup error, such as a timeout, never counts against a domain.
  • If the record is definitely missing on several checks in a row, the domain becomes Lapsed. A lapsed domain is still held by your organization, and its SSO keeps working.
  • Publish the record again to restore it. If it stays missing past the grace period, the domain returns to Pending, and another organization could verify it.
To remove a domain, choose Remove on its row, or run sazabi sso domains remove example.com. A domain that requires SSO can’t be removed; turn enforcement off first.

​
Verify the domain

Once the record is published, choose Verify on the domain’s row, or run:
The domain shows Verified when Sazabi finds the record. If it isn’t found yet, the row says so and shows when it last checked; DNS may still be updating, so try again later. A DNS lookup error is reported separately and never changes the domain’s status. A missing record leaves a pending claim pending. For a domain that’s already verified or lapsed, a check counts like Sazabi’s own checks: if the record has been missing long enough, the domain becomes Lapsed or returns to Pending, and returning to Pending also turns enforcement off.

​
Further reading

Configure SSO

Connect your identity provider next.

Troubleshooting SSO

Fix domain verification failures.