# Approve requests to join your organization

> When somebody signs in with an email address on one of your verified domains, you can let them ask to join your organization.

Source: https://infranest.io/docs/join-requests
Last updated: 2026-10-26

---

This article is for organization admins who want to control who can join their organization when someone signs in using an email address on one of your verified domains.

## Overview

- Matching your domain doesn't grant access automatically — an administrator always decides.
- You choose, per sign-in connection, whether a domain match does nothing or lets someone ask to join.
- Pending requests and approvals happen in **Settings**.

> [!NOTE]
> A matching email address only proves someone has an address on your domain — not that they should have access. Contractors, former staff with lingering accounts, and shared mailboxes can all match. Since members can see every domain, DNS record, server and monitor in your organization, InfraNest treats a domain match as the start of a conversation, not an automatic invitation.

<!-- screenshot: join-requests -->

<!-- docs-screenshots:start:join-requests -->

![Approve requests to join your organization](/media/9b603eac-2f84-4cf8-bb14-2ffc83acb015)

<!-- docs-screenshots:end:join-requests -->

## Choose what a sign-in does

1. Go to **Settings → Sign-in**.
2. Find the sign-in connection you want to configure.
3. Under *When someone signs in with a verified domain*, choose one of:
   - **Do nothing** — they'll need an invitation. This is the default.
   - **Ask an admin** — they can request to join, and you decide.
4. Anyone currently waiting appears under **Requests to join** on the same page. This section only shows up when someone is actually waiting, and administrators get a notification when a new request arrives.

## Approve or deny a request

1. Open **Settings → Sign-in** and find the **Requests to join** section.
2. Review each request — it shows who asked and when.
3. Choose **Approve** to add them as a member with the connection's default role, or **Deny** to turn them away.

> [!WARNING]
> Denying a request is final until you act again — the person signing in won't be added back to your queue automatically. If you change your mind, you'll need to invite them yourself.

New members always arrive with a role that has no write or management permissions. If they need more access, raise their role individually afterwards in **Settings → Members**.

## Troubleshooting

**I'm out of seats on my plan.** Requests still arrive even when your plan is full — you just can't approve them until a seat frees up. Trying to approve will tell you the member limit is reached, but the request stays in the queue so you can approve it later or free up a seat first.

**What does the person asking see?** They sign in successfully and keep whatever access they already had elsewhere — they just aren't part of your organization until you approve them. If they didn't have an account before, InfraNest gives them a personal organization in the meantime, so they're never stuck looking at an empty app.

> [!TIP]
> Set the sign-in connection to **Ask an admin** only for domains you fully control. For anything shared or less certain, leave it at **Do nothing** and send individual invitations instead.