--- title: "Access & Login Security" description: "Login methods, domain verification, white-label, and Entra ID sync" canonical_url: "https://meingpt.com/en/docs/admin-guide/access-and-login-security" language: en --- # Access & Login Security This page is where you configure how users sign in, which email domains are auto-joined into your workspace, and whether Microsoft Entra groups sync with your meinGPT teams. You find it under **Settings → Access**. It is only visible to workspace admins. ## Allowed email domains Users who register with an email on a verified domain are added to your workspace automatically. This replaces one-by-one invitations and at the same time keeps employees from spinning up their own trial accounts on the company email. ### Add and verify a domain 1. Click **Add domain** and enter e.g. `yourcompany.com`. The domain starts in status **Unverified** — auto-join is still off. 2. The verification dialog shows a **Host**, a **Type** (TXT), and a **Value**. Add this entry to the DNS configuration of your domain. 3. Back in meinGPT, click **Check now**. DNS entries usually propagate within 5 minutes — if the check fails immediately, wait a moment and retry. 4. After a successful check, the domain switches to **Verified**, and new registrations with that email suffix are auto-joined from then on. **Suggested domains:** If members with a particular email domain are already in the workspace, meinGPT proactively suggests it ("X members already use this domain"). You can accept the suggestion with a click, but still need to publish the DNS TXT entry before auto-join kicks in. ### Add existing users retroactively When you click the "Apply to existing users" icon on a verified domain, meinGPT lists every person outside this workspace who already has an email on that domain. You can add them all **as viewers** in one step. Existing memberships in other workspaces are untouched. ### Remove a domain Removing a domain stops auto-join — existing memberships are **not** removed. If you add the domain back later, you have to re-verify it via DNS TXT. ### Block workspace invites from external workspaces Every **Verified** domain carries one more toggle: **"Allow users with this domain to be added to other workspaces."** Switch it off to make your workspace the only home for that domain — from then on, nobody with that email suffix can be invited or added into any *other* meinGPT workspace. Invite emails, join links, manual adds by external admins, and adds via the API are all refused. Existing memberships elsewhere are left untouched, and re-adding someone to your own workspace always works. Only addresses that actually match the domain are covered — e.g. a contractor on `gmail.com` who happens to be in your workspace is unaffected. **Default:** domains you add from now on start with this **off** (your users are locked to your workspace). Domains that already existed when this option shipped were grandfathered to *allowed* — turn the toggle off on the ones you want to restrict. ### Recommendation Add domains early so employees don't spin up parallel trial workspaces on the company domain in the meantime. ### Membership in multiple workspaces If a user is already a member of more than one meinGPT workspace — for example through an old trial account, a different group company with its own workspace, or an external consultant login — they do **not** land in a specific workspace automatically at sign-in. Instead, meinGPT shows a workspace selection screen where they choose which workspace to sign into. This applies regardless of whether they sign in via magic link, Google, or Microsoft, and is expected behavior when someone holds multiple memberships — not a bug. This selection screen only ever appears on the very first login: afterwards, meinGPT remembers which workspace was chosen and routes every subsequent login straight there — which is exactly why the picker is only ever visible on that first login, even for brand-new accounts. The duplicate membership behind this doesn't have to come from an old, orphaned account either: it can arise in the very same moment a brand-new account is created via SSO — for example if another, older workspace still has a pending invite out for the same email address at that time (such as from a forgotten pilot or test workspace). Domain verification and auto-join (see above) only control whether **new** registrations automatically join your workspace. They do not remove or move **existing** memberships in other workspaces — not even when you turn off "Allow users with this domain to be added to other workspaces." **If employees report being asked which workspace to sign into at SSO login instead of landing in yours automatically:** this points to an existing second membership. Ask the affected person which other workspace(s) appear in the selection screen, and pass that information to our support team — we can remove or consolidate the redundant membership. ## Custom domain (white-label) You can reach your workspace from your own hostname, e.g. `chat.yourcompany.com` instead of `app.meingpt.com`. This is a **paid add-on** and is set up together with our team. A custom domain is useful when: - you want to present meinGPT to your employees under your own brand - you want a stable company URL in onboarding material and internal communications - your SSO security policy requires avoiding third-party hostnames What happens during setup (together with our team): - DNS entry on your side (CNAME or A-record pointing to our endpoint) - TLS certificate on our side via Let's Encrypt - Microsoft and Google SSO use our central callback address; new custom domains no longer need separate OAuth redirect URIs - origin allow-list updated on our backend for CORS and Stripe redirects To start the conversation: open **Access & Login Security → Custom domain** in workspace settings and click "Contact sales", or email [enterprise@meingpt.com](mailto:enterprise@meingpt.com) directly. ## Authentication methods This is where you decide which methods users can use to register and sign in to your workspace. Three methods are available — all three are enabled by default: - **Email (magic link)** — passwordless sign-in via a one-time link sent to the user's email. The link is valid for **15 minutes** and works only once; requesting a new link immediately invalidates the previous one. - **Google** — sign-in via Google account (particularly handy for Google Workspace customers) - **Microsoft** — sign-in via Microsoft account (personal, school, or work). Works without any further configuration; an Entra setup is **not** required for this — see the next section if you additionally want to sync groups. At least one method must stay enabled — meinGPT prevents you from disabling the last one. ### Pre-filtered login link Below the toggles you find a pre-generated login URL of the form `app.meingpt.com/auth?login=microsoft,email`. It lists the currently enabled methods as URL parameters. Visitors who open this link only see the pre-selected options on the sign-in page — other methods stay hidden. Typical use: hand a Microsoft-only link to your workforce so employees don't accidentally create a parallel account via magic link on their personal address. The URL updates automatically as you toggle methods on or off. ### Magic link email arrives late or not at all If a magic link takes more than a few minutes to arrive, it's almost always caught by mail filtering rather than lost: 1. **Check spam/junk first** — the most common cause. 2. **Ask your IT team to allowlist `meingpt.com`** (SPF-verified sender / safe-sender list) in your corporate mail gateway (e.g. Microsoft Defender for Office 365, Mimecast, Proofpoint). Gateways that hold messages for scanning are the most common reason a magic link email arrives after its 15-minute window has already expired. 3. **Always use the newest email** — every new link request invalidates the previous one, so an older email's link stops working even if it looks unused. 4. **Repeated requests are rate-limited** — up to 5 link requests per 15 minutes per email address; further attempts in that window are rejected until it resets. If emails still don't arrive after allowlisting, contact [enterprise@meingpt.com](mailto:enterprise@meingpt.com). ## Entra ID sync If you use Microsoft Entra ID (formerly Azure AD), you can link Entra groups to your meinGPT teams. The sync is add-only and runs on every login: users are automatically added to the matching teams, but never automatically removed — removing someone from the Entra group leaves them in the meinGPT team until an admin removes them manually. This section only appears once your workspace is enabled for Entra sync. Reach out to us if you don't see it and need it. ### One-time authorization 1. Click **Authorize**. A Microsoft popup opens asking for admin consent on your tenant — this step must be performed by someone with Microsoft admin rights. 2. Once consent is granted, meinGPT stores the tenant ID. No separate manual configuration is needed. ### Enable group synchronization The **switch next to the section title** controls whether Entra groups are actually synced. On first activation or after tenant changes, meinGPT may require a **re-authorization** — the banner "Re-authorization may be required" indicates this. In that case, just click **Re-authorize** again. Which Entra group is wired to which meinGPT team is configured in team settings afterwards (see [Team management → Entra sync](/en/docs/admin-guide/team-management)). ### Restrict access additionally on the Microsoft side If you want to limit meinGPT access to specific Entra groups, that's done **on the Microsoft side** via Conditional Access: block the "meinGPT" application for everyone and explicitly grant access to the chosen groups. This complements the authentication toggles in meinGPT but does not replace them. ## Technical Deep Dive - [Connections (Cloud/on-Prem)](/en/docs/integrations/connections-cloud-on-prem) - [Identity Forwarding](/en/docs/integrations/jwt-identity-forwarding)