> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# sazabi_sso_domain

> Terraform resource for an email domain claimed for single sign-on.

Claims an email domain for the organization's single sign-on. The claim outputs the TXT record that proves the organization controls the domain: publish it with your DNS provider's record resource, then add `sazabi_sso_domain_verification` to wait until Sazabi sees it. Destroying the resource removes the claim; the API refuses while the domain enforces SSO.

Enforcement is read only here. Only an owner signed in to the dashboard can turn SSO enforcement on or off.

## Example

```hcl theme={"system"}
resource "sazabi_sso_domain" "example" {
  domain = "example.com"
}

resource "aws_route53_record" "sazabi_verification" {
  zone_id = aws_route53_zone.example.zone_id
  name    = sazabi_sso_domain.example.verification_record_name
  type    = sazabi_sso_domain.example.verification_record_type
  ttl     = 300
  records = [sazabi_sso_domain.example.verification_record_value]
}
```

## Arguments

| Attribute | Type | Behavior | Description |
| - | - | - | - |
| `domain` | string | Required | Domain to claim, such as `example.com`, in lowercase with no trailing dot. Matched exactly: subdomains are not covered. Immutable. |
| `organization_id` | string | Optional, Computed | Owning organization. Defaults to the provider's organization, then to the API key's. Immutable. |
| `id` | string | Computed | Domain claim ID. |
| `status` | string | Computed | `pending`, `verified`, or `lapsed` (re-checks no longer find the TXT record). |
| `verification_record_type` | string | Computed | Always `TXT`. |
| `verification_record_name` | string | Computed | `_sazabi-verification.<domain>`. |
| `verification_record_value` | string | Computed | `sazabi-domain-verification=<token>`. |
| `verified_at` | string | Computed | When the domain was verified, or null. |
| `last_checked_at` | string | Computed | The last re-check that got a definite answer from DNS, or null. |
| `enforce_sso` | bool | Computed | Whether SSO is enforced for this domain. Read only. |
| `created_at` | string | Computed | When the domain was claimed. |

Creating a domain the organization has already claimed fails; import it instead.

## Import

```bash theme={"system"}
terraform import sazabi_sso_domain.example example.com
terraform import sazabi_sso_domain.example <organization_id>/example.com
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.