Email domains & enforcement

These are the last two steps of the SSO setup wizard. They control how your team finds the SSO sign-in and whether SSO is mandatory. Email-domain claims also have a standalone manager on the main Settings > Single Sign-On page; enforcement and the sign-in slug are set in the wizard’s final step.

Claim an email domain

Claiming a domain you own lets anyone with a matching email address be routed straight to your IdP from the Glueprint login page — no deep link needed.

1. In Settings > Single Sign-On, find the Email-domain claims card and click Manage (this is also the wizard’s Claim domain step).
2. Enter a domain you own, e.g. acme.com, and click Add.
3. Glueprint shows a DNS TXT record to publish. Add it at your DNS provider:
   • Name: _glueprint-verify.acme.com
   • Value: the verification string shown in the portal
4. Once the record has propagated, click Verify.

When verification succeeds the domain’s status flips to verified.

Notes:

• Exact match only. Verifying acme.com does not cover subdomains like eu.acme.com — claim each domain you need.
• Consumer domains are blocked. Public email domains (gmail.com, outlook.com, and similar) can’t be claimed.
• DNS can take time. If verification fails right after you add the record, wait for propagation and try again.

You can claim more than one domain. Claiming is optional — without it, members sign in via your deep link (below).

Your sign-in deep link

Each tenant gets a slug that forms a direct sign-in URL:

https://portal.glueprint.ai/sso/{your-slug}

In the Enforcement step, set the Tenant slug field. It must be 3-32 characters, lowercase letters, digits, or hyphens (no leading or trailing hyphen). The portal shows the resulting link as you type.

Share this link with your team as the sign-in entry point — use it when you haven’t claimed an email domain. (This deep link is SP-initiated: it starts the login at Glueprint. It’s distinct from true IdP-initiated login, where users start from your IdP’s dashboard tile — an optional SAML setting covered in Set up SSO.)

Choose an enforcement policy

In the Enforcement step, pick one:

Mode	Behavior
Off	SSO is configured but disabled. Use this to pause SSO without losing your configuration.
Optional	Members can sign in with either SSO or a password. Recommended while you roll out.
Required	Members must sign in via SSO.

Owner break-glass

Even in Required mode, account owners keep a password fallback so an IdP outage can never lock you out of your own account. Every break-glass login is recorded in the audit log.

Before requiring SSO

Test SSO as an owner first. Make sure at least one owner has successfully signed in via SSO before switching to Required. If you choose Required without a verified email domain, the portal asks you to type your tenant slug to confirm — because members will only be able to reach sign-in through your /sso/{slug} deep link.

Related topics

• SSO overview
• Set up SSO step by step
• SCIM provisioning