Access & Login Security

This page is where you configure how users sign in, whether your own identity provider (Keycloak, Okta, PingFederate, ...) handles the login, which email domains are auto-joined into your workspace, and whether Microsoft Entra groups sync with your MeinGPT teams.

You find it under Settings → Access. It is only visible to workspace admins.

Allowed email domains

Users who register with an email on a verified domain are added to your workspace automatically. This replaces one-by-one invitations and at the same time keeps employees from spinning up their own trial accounts on the company email.

Add and verify a domain

1. Click Add domain and enter e.g. yourcompany.com. The domain starts in status Unverified — auto-join is still off.
2. The verification dialog shows a Host, a Type (TXT), and a Value. Add this entry to the DNS configuration of your domain.
3. Back in MeinGPT, click Check now. DNS entries usually propagate within 5 minutes — if the check fails immediately, wait a moment and retry.
4. After a successful check, the domain switches to Verified, and new registrations with that email suffix are auto-joined from then on.

Add existing users retroactively

When you click the "Apply to existing users" icon on a verified domain, MeinGPT lists every person outside this workspace who already has an email on that domain. You can add them all as viewers in one step. Existing memberships in other workspaces are untouched.

Remove a domain

Removing a domain stops auto-join — existing memberships are not removed. If you add the domain back later, you have to re-verify it via DNS TXT.

Block workspace invites from external workspaces

Every Verified domain carries one more toggle: "Allow users with this domain to be added to other workspaces." Switch it off to make your workspace the only home for that domain — from then on, nobody with that email suffix can be invited or added into any other MeinGPT workspace. Invite emails, join links, manual adds by external admins, and adds via the API are all refused. Existing memberships elsewhere are left untouched, and re-adding someone to your own workspace always works. Only addresses that actually match the domain are covered — e.g. a contractor on gmail.com who happens to be in your workspace is unaffected.

Recommendation

Add domains early so employees don't spin up parallel trial workspaces on the company domain in the meantime.

Membership in multiple workspaces

If a user is already a member of more than one MeinGPT workspace — for example through an old trial account, a different group company with its own workspace, or an external consultant login — they do not land in a specific workspace automatically at sign-in. Instead, MeinGPT shows a workspace selection screen where they choose which workspace to sign into. This applies regardless of whether they sign in via magic link, Google, Microsoft, or your own identity provider, and is expected behavior when someone holds multiple memberships — not a bug.

This selection screen only ever appears on the very first login: afterwards, MeinGPT remembers which workspace was chosen and routes every subsequent login straight there — which is exactly why the picker is only ever visible on that first login, even for brand-new accounts.

Users can switch workspaces themselves at any time: click Switch Organisations at the bottom of the user menu. The entry only appears if the account is a member of more than one workspace.

The duplicate membership behind this doesn't have to come from an old, orphaned account either: it can arise in the very same moment a brand-new account is created via SSO — for example if another, older workspace still has a pending invite out for the same email address at that time (such as from a forgotten pilot or test workspace).

Domain verification and auto-join (see above) only control whether new registrations automatically join your workspace. They do not remove or move existing memberships in other workspaces — not even when you turn off "Allow users with this domain to be added to other workspaces."

If employees report being asked which workspace to sign into at SSO login instead of landing in yours automatically: this points to an existing second membership. Ask the affected person which other workspace(s) appear in the selection screen, and pass that information to our support team — we can remove or consolidate the redundant membership.

Getting an additional workspace

You create a workspace of your own yourself only at the first registration, and only with an account that is not yet a member of any workspace. If you are already a member of a workspace, you cannot create another one yourself. Registering again with the same email address does not create a second workspace either.

If, as an existing user, you need an additional workspace, our team sets it up for you. Write to sales@meingpt.com or to support and give us the workspace name you want and the email address that should be its admin. The same email address can be a member of several workspaces; you switch between them via Switch Organisations (see above).

Each workspace has its own billing and its own credit balance, see Manage billing.

Custom domain (white-label)

You can reach your workspace from your own hostname, e.g. chat.yourcompany.com instead of app.meingpt.com. This is a paid add-on and is set up together with our team.

A custom domain is useful when:

• you want to present MeinGPT to your employees under your own brand
• you want a stable company URL in onboarding material and internal communications
• your SSO security policy requires avoiding third-party hostnames

What happens during setup (together with our team):

• DNS entry on your side (CNAME or A-record pointing to our endpoint)
• TLS certificate on our side via Let's Encrypt
• Microsoft, Google, and workspace SSO use our central callback address; new custom domains no longer need separate OAuth redirect URIs
• origin allow-list updated on our backend for CORS and Stripe redirects

To start the conversation: open Access & Login Security → Custom domain in workspace settings and click "Contact sales", or email enterprise@meingpt.com directly.

Network access (firewall / proxy)

Even if you use MeinGPT under your own domain, your browser loads some content from MeinGPT addresses outside that domain. In your company's firewall and proxy, also allow outbound HTTPS to:

• cdn.meingpt.com - images of the platform, for example the Notetaker preview images in the Meetings settings
• assets.meingpt.com - interface of the Outlook add-in

If cdn.meingpt.com is blocked, such images show as empty image placeholders. To allow all MeinGPT addresses at once, allow *.meingpt.com.

Authentication methods

This is where you decide which methods users can use to register and sign in to your workspace. Three methods are enabled by default:

• Email (magic link) — passwordless sign-in via a one-time link sent to the user's email. The link is valid for 15 minutes and works only once; requesting a new link immediately invalidates the previous one.
• Google — sign-in via Google account (particularly handy for Google Workspace customers)
• Microsoft — sign-in via Microsoft account (personal, school, or work). Works without any further configuration; an Entra setup is not required for this — see Entra ID sync if you additionally want to sync groups.

A fourth method, SSO (OpenID Connect), appears in the list once you have set up your own identity provider (see Single sign-on with your own identity provider). It is enabled automatically when the provider is saved and can be toggled here like the other methods.

At least one method must stay enabled — MeinGPT prevents you from disabling the last one.

How sign-in works

The sign-in page first asks only for the email address. After Continue, MeinGPT shows the methods allowed by the workspace that owns that email domain — and only those. For an address on one of your verified domains that is exactly the set of toggles above; for an unknown address (say, a personal Gmail address) it is all default methods.

• Anyone who has signed in from this browser before skips the first step: MeinGPT remembers the address and the method used last time.
• Not you? Change email goes back to the input.
• The typed address only selects the buttons. Whoever then signs in via Google, Microsoft, or SSO as someone else lands in that person's account — what the login service confirms is what counts.

What happens when the magic link is opened

• Opening is not signing in yet: When the link is opened, MeinGPT first shows a confirmation page. Existing users see "Welcome back" with their account and the Continue button; new users set up their profile first. Only clicking Continue (or submitting the profile) uses up the link and signs the person in. Until then the link can be opened any number of times within the 15 minutes. A mail scanner that only fetches the link does not use it up either.
• Opening it again: A link that has already been used shows "The Magic Link has already been used". A link older than 15 minutes, or replaced by a newer request, shows "The Magic Link has already expired". In both cases the person requests a new link from the sign-in page. A browser that is still signed in goes straight into the workspace without an error.
• Reloading the page: After opening, MeinGPT removes the link from the address bar. Reloading the confirmation page shows the normal sign-in page. The link itself stays valid and can be opened again from the email.
• Another device or browser: The link is not tied to a device or browser. The email can be read on a phone and the link opened on a laptop. The person is signed in in the browser where they click Continue; the browser where the link was requested stays signed out. If 2FA is active, MeinGPT asks for the code on that device.

Pre-filtered login link

Below the toggles you find a pre-generated login URL of the form app.meingpt.com/auth?login=microsoft,email. It lists the currently enabled methods as URL parameters. Visitors who open this link only see the pre-selected options on the sign-in page — other methods stay hidden.

This link is not the one-time link from the sign-in email: it only pre-selects which sign-in methods are shown.

Typical use: hand a Microsoft-only link to your workforce so employees don't accidentally create a parallel account via magic link on their personal address. The URL updates automatically as you toggle methods on or off.

If your own identity provider is set up, the link additionally carries sso=<id>. That lets members whose email domain belongs to another workspace (external consultants, for example) find your workspace's SSO button.

How long do I stay signed in?

After signing in, a person stays signed in for up to about one week. After that they have to sign in again, which with e-mail login means a new magic link. The duration cannot be changed in the workspace settings. If someone has to sign in much more often, the cause is usually the browser, for example policies that clear cookies on close or on a schedule, or use of a private window.

Magic link email arrives late or not at all

If a magic link takes more than a few minutes to arrive, it's almost always caught by mail filtering rather than lost:

1. Check spam/junk first — the most common cause.
2. Ask your IT team to allowlist meingpt.com (SPF-verified sender / safe-sender list) in your corporate mail gateway (e.g. Microsoft Defender for Office 365, Mimecast, Proofpoint). Gateways that hold messages for scanning are the most common reason a magic link email arrives after its 15-minute window has already expired.
3. Always use the newest email — every new link request invalidates the previous one, so an older email's link stops working even if it looks unused.
4. Repeated requests are rate-limited — up to 5 link requests per 15 minutes per email address; further attempts in that window are rejected until it resets.

If emails still don't arrive after allowlisting, contact enterprise@meingpt.com.

Single sign-on with your own identity provider (OIDC)

If your company runs its own identity provider, your employees sign in to MeinGPT with it — passwords, two-factor rules, and account lockouts stay entirely with you. Any provider that speaks OpenID Connect works, for example Keycloak, Okta, PingFederate, Authentik, or Microsoft Entra ID. SAML is not supported.

Setup

The client secret is stored encrypted and never shown again. To rotate it, simply enter a new one; leaving the field empty when editing keeps the stored secret.

What happens at login

When someone enters an address on one of your verified domains on the sign-in page, the SSO button appears. Clicking it leads to your identity provider; after signing in there, the browser returns to MeinGPT.

On a person's first sign-in, MeinGPT links the identity from your provider to a MeinGPT account. The rule:

• If your provider reports the email address as verified and it is on one of your verified domains, the account is created or linked immediately and the person joins your workspace. The domain has to be verified by DNS record or by our support team. Domains carried over as verified from the earlier domain list don't count here.
• Otherwise MeinGPT first sends a confirmation email to the address. Only clicking that link creates the link between the identities. This keeps any provider from claiming an address it doesn't own. The email names your workspace and your provider, and the link only works in the browser where the sign-in was started.

From the second sign-in on, only the identity at your provider counts — even if the person's email address there has changed since. This holds while the person is a member of your workspace; after they leave, their next sign-in follows the first-sign-in rules again.

Changing or removing the provider

You can enter a new client secret at any time without any change for your users. When you change the Issuer URL, enter the client secret again; MeinGPT never sends the stored secret to a new issuer. If you change the Issuer URL or the Client ID, or click Remove SSO provider, MeinGPT drops all existing SSO links and ends this workspace's running SSO sessions: everyone signs in again next time and is linked anew. Removing the provider disables the SSO method; at least one other method must be enabled first.

What stays with your provider

Multi-factor authentication, password rules, conditional access, and disabling users are configured at your identity provider. A user disabled there can no longer start a new MeinGPT sign-in; an already running session ends with its normal validity. If someone must lose access to your workspace immediately, also remove them in Member Management.

Entra ID sync

If you use Microsoft Entra ID (formerly Azure AD), you can link Entra groups to your MeinGPT teams. The sync is add-only and runs on every login: users are automatically added to the matching teams, but never automatically removed — removing someone from the Entra group leaves them in the MeinGPT team until an admin removes them manually.

One-time authorization

1. Click Authorize. A Microsoft popup opens asking for admin consent on your tenant — this step must be performed by someone with Microsoft admin rights.
2. Once consent is granted, MeinGPT stores the tenant ID. No separate manual configuration is needed.

Enable group synchronization

The switch next to the section title controls whether Entra groups are actually synced. On first activation or after tenant changes, MeinGPT may require a re-authorization — the banner "Re-authorization may be required" indicates this. In that case, just click Re-authorize again.

Which Entra group is wired to which MeinGPT team is configured in team settings afterwards (see Team management → Entra sync). For SCIM-based user provisioning from Entra ID — a separate but related step — see Entra ID SCIM provisioning.

Restrict access additionally on the Microsoft side

If you want to limit MeinGPT access to specific Entra groups, that's done on the Microsoft side via Conditional Access: block the "MeinGPT" application for everyone and explicitly grant access to the chosen groups. This complements the authentication toggles in MeinGPT but does not replace them.

Technical Deep Dive

• Connections (Cloud/on-Prem)
• Identity Forwarding