> ## Documentation Index > Fetch the complete documentation index at: https://docs.athenahq.ai/llms.txt > Use this file to discover all available pages before exploring further. # Sign-in & access (Security Settings) > Let organization admins control who can join automatically by email domain (at org and website level) and configure single sign-on (SSO) plus SCIM user provisioning for their identity provider. `app.athenahq.ai/settings/security` ## Purpose The Sign-in & access settings page allows organization administrators to control how teammates join their workspace and authenticate. It eliminates the need to manually invite every team member by enabling domain-based auto-join, and it provides enterprise-grade security controls like Single Sign-On (SSO) and SCIM user provisioning. Administrators can configure domain access at two levels: organization-wide (giving users access to the entire workspace) or website-restricted (limiting users to specific tracked websites). For enterprise customers, this page is also where they connect their own SAML or OIDC identity provider (like Okta, Google Workspace, or Microsoft Entra) and automate account creation and deactivation. ## What's on the page ### Organization access This section lists domains that grant users access to your entire organization. It includes an **Add Domain** button to configure a new domain. * **Domain list**: Displays each configured `@domain`. * **Verification badge**: Shows a green **Verified** badge if the domain has been verified via DNS or matching member emails. If unverified, an amber **Verify DNS** badge appears. * **Default role**: A badge indicating the role (e.g., "Viewer", "Admin", or a custom role) assigned to anyone joining via this domain. * **Edit**: A button that opens the "Edit @\[domain]" dialog. ### Website access This section lists domains configured to grant access only to specific websites rather than the whole organization. * **Domain list**: Grouped by `@domain`. * **Verification badge**: Shows **Verified** or **Verify DNS** (functions identically to the org-tier badge). * **Associated websites**: A sub-list displaying the logo and name of every website users with this domain are allowed to access. * **Default role**: A badge indicating the assigned role. * **Edit**: A button to adjust the role, add/remove websites, or remove the domain entirely. ### Single sign-on This section manages SSO setup and is available to customers on the Enterprise plan. If unconfigured, a setup form prompts for a company email domain. If configured, it displays: * **Status header**: Shows the active protocol (SAML or OIDC) and an **Active** badge. * **Options menu (⋯)**: An overflow menu in the top right containing the option to remove SSO. Displays a tooltip for non-admins: "Only org admins can remove the SSO provider." * **Default role for new users**: Displays the role assigned to new users joining via SSO. Includes an **Edit** button with a tooltip for non-admins: "Only org admins can change the SSO default role, since it grants that role to every new SSO member." * **Connection details**: An expandable drawer revealing click-to-copy fields required by the identity provider (Issuer, Callback URL, SP metadata URL). ### SCIM provisioning This section appears only after an SSO provider is configured. It allows admins to manage automated user syncing. * **SCIM endpoint**: A read-only click-to-copy field showing the base URL required for the identity provider. * **Token status**: Displays whether the current token is **Active**, **Revoked**, or **Not configured**. * **Generate SCIM token / Rotate SCIM token**: A button to create or refresh the required bearer token. * **How to set up SCIM in your identity provider**: An expandable drawer detailing step-by-step setup instructions. **SCIM attribute mapping table** Inside the SCIM setup drawer, a table explains how fields should be mapped in the identity provider. * **Identity provider field**: The SCIM attribute name (e.g., `userName`, `name.givenName`, `name.familyName`, `active`). * **AthenaHQ field**: What the field corresponds to in the app (Email, First name, Last name, Active status). ## What you can do here * **Add Domain (organization access)**: Click the **Add Domain** button to open the "Add Email Domain" dialog. Enter a domain, pick a default role, and click **Add Domain** to save. * **Add Domain (website access)**: Click the **Add Domain** button to open the "Add website access domain" dialog. Enter a domain, select the target websites from the dropdown, choose a default role, and click **Add Domain**. * **Verify DNS**: Click the **Verify DNS** badge next to an unverified domain to open the "Verify domain ownership" dialog. It displays a TXT record to add to your DNS provider. Once added, click **Verify**. * **Edit domain settings**: Click **Edit** next to any domain to open its edit dialog. You can change the default role, update the website list (for website-tier domains), or click **Remove domain** (a destructive action) to delete the rule entirely. * **Set up SSO**: Enter your company email domain and click **Continue**. The wizard will walk you through DNS verification (if needed) and provide tabs to enter OIDC or SAML configuration details. Click **Finish setup** or **Verify domain and finish setup** to complete. * **Remove SSO**: Click the **⋯** menu in the Single sign-on card and select **Remove SSO**. A destructive confirmation dialog will appear: "Remove SSO provider? Everyone signing in with an @\[domain] email will go back to email codes or Google/Microsoft sign-in. Existing members keep their access." Click **Remove SSO** to confirm. * **Change SSO default role**: Click **Edit** next to the SSO "Default role for new users" row. Select a new role and click **Save**. * **Generate / Rotate SCIM token**: Click the **Generate SCIM token** (or **Rotate SCIM token**) button. Provide an optional label and click **Generate token** (or **Rotate token**). The new token is displayed once. You must copy it before closing the dialog. * **Copy connection details**: Click any inline code snippet (like a callback URL, DNS TXT record, or SCIM token) to copy it to your clipboard. A tooltip will confirm with "Copied!". * **Upgrade to Enterprise**: If the org is not on the Enterprise plan, the SSO section displays an upsell card. Click **View plans** to open the pricing plans dialog and subscribe. ## Data shown * **Your auto-join domains**: A list of domains your team has configured to automatically grant access to the workspace or specific websites. * **SSO configuration**: The SAML/OIDC identity provider settings linked to your organization. * **SCIM connection**: Token status and endpoint URLs used to sync your identity provider's user directory with the application. ## Common workflows **Setting up a domain for website auto-join** 1. Under Website access, click **Add Domain**. 2. In the dialog, type the company domain (e.g., `acmecorp.com`). 3. Select one or more websites from the dropdown that users should get access to. 4. Select a default role, then click **Add Domain**. 5. If the domain isn't already verified, click the **Verify DNS** badge, copy the provided TXT record to your DNS host, and click **Verify**. **Configuring Single Sign-On (SSO)** 1. Under Single sign-on, enter your company email domain and click **Continue**. 2. Complete the DNS verification step if the domain isn't already verified. 3. Choose the OIDC or SAML tab based on your identity provider. 4. Copy the provided Callback URL (and Entity ID) into your identity provider's SSO app. 5. Paste the Issuer URL, Client ID, and Client Secret (or Metadata URL for SAML) back into the AthenaHQ form. 6. Click **Finish setup**. **Rotating a SCIM token** 1. Under SCIM provisioning, click **Rotate SCIM token**. 2. Read the warning that the previous token will be revoked immediately. 3. Click **Rotate token**. 4. Click the newly generated token to copy it, then update your identity provider's SCIM configuration. 5. Click **Done** to close the dialog. ## Empty, loading, and error states * **Empty**: If no domains are configured for either tier, the list displays "No domains configured." * **Loading**: A centered animated spinner appears while the page's core data loads. The domain lists display skeleton rows while fetching data. * **Error**: If the SSO configuration fails to load, the section displays "Couldn't load your SSO configuration." with a **Retry** button. If the SCIM token status fails to load, it displays "Couldn't load token status" in red/amber text. ## Linked from / links to * **Linked from**: The Settings sidebar navigation menu (Settings → Sign-in & access). * **Links to**: The "Verify domain ownership" dialog includes links to the detected DNS provider's dashboard and support documentation. The "View plans" button opens the pricing plans dialog. ## Common support questions **Why is my domain asking to "Verify DNS"?** If the domain you added doesn't match the verified email address of an existing member in your organization, the system requires you to prove ownership by adding a specific TXT record to your DNS provider. This prevents unauthorized users from claiming domains they don't own. **Can I stop users from joining automatically without deleting the domain?** You must remove the domain to stop auto-joins completely. If you only want to restrict what they can see, you can edit the domain and change its Default Role to a more restricted custom role, or move it from "Organization access" to "Website access" so they only see specific dashboards. **If I remove a website domain, do users lose access?** Removing a website from a domain's access list (or removing the domain entirely) will revoke the specific memberships that the domain previously granted. However, if a user also gained access through a direct invitation or an organization-wide role, they will retain that level of access. **Why can't I set the default role to Admin?** Setting a default auto-join role or an SSO default role above "Viewer" requires you to be an active Organization Administrator. This is a security measure to prevent non-admins from accidentally (or intentionally) creating a pathway that grants administrative privileges to new users.