Login methods, domain verification, white-label, and Entra ID sync
This page is where you configure how users sign in, which email domains are auto-joined into your workspace, and whether Microsoft Entra groups sync with your meinGPT teams.
You find it under Settings → Access. It is only visible to workspace admins.
Users who register with an email on a verified domain are added to your workspace automatically. This replaces one-by-one invitations and at the same time keeps employees from spinning up their own trial accounts on the company email.
Click Add domain and enter e.g. yourcompany.com. The domain starts in status Unverified — auto-join is still off.
The verification dialog shows a Host, a Type (TXT), and a Value. Add this entry to the DNS configuration of your domain.
Back in meinGPT, click Check now. DNS entries usually propagate within 5 minutes — if the check fails immediately, wait a moment and retry.
After a successful check, the domain switches to Verified, and new registrations with that email suffix are auto-joined from then on.
Note
Suggested domains: If members with a particular email domain are already in the workspace, meinGPT proactively suggests it ("X members already use this domain"). You can accept the suggestion with a click, but still need to publish the DNS TXT entry before auto-join kicks in.
When you click the "Apply to existing users" icon on a verified domain, meinGPT lists every person outside this workspace who already has an email on that domain. You can add them all as viewers in one step. Existing memberships in other workspaces are untouched.
Every Verified domain carries one more toggle: "Allow users with this domain to be added to other workspaces." Switch it off to make your workspace the only home for that domain — from then on, nobody with that email suffix can be invited or added into any other meinGPT workspace. Invite emails, join links, manual adds by external admins, and adds via the API are all refused. Existing memberships elsewhere are left untouched, and re-adding someone to your own workspace always works. Only addresses that actually match the domain are covered — e.g. a contractor on gmail.com who happens to be in your workspace is unaffected.
Note
Default: domains you add from now on start with this off (your users are locked to your workspace). Domains that already existed when this option shipped were grandfathered to allowed — turn the toggle off on the ones you want to restrict.
If a user is already a member of more than one meinGPT workspace — for example through an old trial account, a different group company with its own workspace, or an external consultant login — they do not land in a specific workspace automatically at sign-in. Instead, meinGPT shows a workspace selection screen where they choose which workspace to sign into. This applies regardless of whether they sign in via magic link, Google, or Microsoft, and is expected behavior when someone holds multiple memberships — not a bug.
This selection screen only ever appears on the very first login: afterwards, meinGPT remembers which workspace was chosen and routes every subsequent login straight there — which is exactly why the picker is only ever visible on that first login, even for brand-new accounts.
The duplicate membership behind this doesn't have to come from an old, orphaned account either: it can arise in the very same moment a brand-new account is created via SSO — for example if another, older workspace still has a pending invite out for the same email address at that time (such as from a forgotten pilot or test workspace).
Domain verification and auto-join (see above) only control whether new registrations automatically join your workspace. They do not remove or move existing memberships in other workspaces — not even when you turn off "Allow users with this domain to be added to other workspaces."
If employees report being asked which workspace to sign into at SSO login instead of landing in yours automatically: this points to an existing second membership. Ask the affected person which other workspace(s) appear in the selection screen, and pass that information to our support team — we can remove or consolidate the redundant membership.
You can reach your workspace from your own hostname, e.g. chat.yourcompany.com instead of app.meingpt.com. This is a paid add-on and is set up together with our team.
A custom domain is useful when:
you want to present meinGPT to your employees under your own brand
you want a stable company URL in onboarding material and internal communications
your SSO security policy requires avoiding third-party hostnames
What happens during setup (together with our team):
DNS entry on your side (CNAME or A-record pointing to our endpoint)
TLS certificate on our side via Let's Encrypt
Microsoft and Google SSO use our central callback address; new custom domains no longer need separate OAuth redirect URIs
origin allow-list updated on our backend for CORS and Stripe redirects
To start the conversation: open Access & Login Security → Custom domain in workspace settings and click "Contact sales", or email enterprise@meingpt.com directly.
This is where you decide which methods users can use to register and sign in to your workspace. Three methods are available — all three are enabled by default:
Email (magic link) — passwordless sign-in via a one-time link sent to the user's email. The link is valid for 15 minutes and works only once; requesting a new link immediately invalidates the previous one.
Google — sign-in via Google account (particularly handy for Google Workspace customers)
Microsoft — sign-in via Microsoft account (personal, school, or work). Works without any further configuration; an Entra setup is not required for this — see the next section if you additionally want to sync groups.
At least one method must stay enabled — meinGPT prevents you from disabling the last one.
Below the toggles you find a pre-generated login URL of the form app.meingpt.com/auth?login=microsoft,email. It lists the currently enabled methods as URL parameters. Visitors who open this link only see the pre-selected options on the sign-in page — other methods stay hidden.
Typical use: hand a Microsoft-only link to your workforce so employees don't accidentally create a parallel account via magic link on their personal address. The URL updates automatically as you toggle methods on or off.
If a magic link takes more than a few minutes to arrive, it's almost always caught by mail filtering rather than lost:
Check spam/junk first — the most common cause.
Ask your IT team to allowlist meingpt.com (SPF-verified sender / safe-sender list) in your corporate mail gateway (e.g. Microsoft Defender for Office 365, Mimecast, Proofpoint). Gateways that hold messages for scanning are the most common reason a magic link email arrives after its 15-minute window has already expired.
Always use the newest email — every new link request invalidates the previous one, so an older email's link stops working even if it looks unused.
Repeated requests are rate-limited — up to 5 link requests per 15 minutes per email address; further attempts in that window are rejected until it resets.
If you use Microsoft Entra ID (formerly Azure AD), you can link Entra groups to your meinGPT teams. The sync is add-only and runs on every login: users are automatically added to the matching teams, but never automatically removed — removing someone from the Entra group leaves them in the meinGPT team until an admin removes them manually.
Note
This section only appears once your workspace is enabled for Entra sync. Reach out to us if you don't see it and need it.
The switch next to the section title controls whether Entra groups are actually synced. On first activation or after tenant changes, meinGPT may require a re-authorization — the banner "Re-authorization may be required" indicates this. In that case, just click Re-authorize again.
Which Entra group is wired to which meinGPT team is configured in team settings afterwards (see Team management → Entra sync).
If you want to limit meinGPT access to specific Entra groups, that's done on the Microsoft side via Conditional Access: block the "meinGPT" application for everyone and explicitly grant access to the chosen groups. This complements the authentication toggles in meinGPT but does not replace them.