Approve requests to join your organization

Control who from your company can join your organization when they sign in with a company email address — this is for administrators who manage team access.

Overview

• When someone signs in with an email address on one of your verified domains, you can choose to let them request to join your organization.
• Nobody is ever added automatically — an administrator always decides.
• This matters because a matching email address only proves someone has that address, not that they should have access. Anyone in your organization can see every domain, DNS record, server and monitor in it, so join requests start a conversation rather than granting access outright.

Choose what a sign-in does

1. Go to Settings → Sign-in.
2. Find the sign-in connection you want to configure, under When someone signs in with a verified domain.
3. Choose one of the two options:
   • Do nothing — the person will need an invitation to join. This is the default.
   • Ask an admin — the person can request to join, and an administrator decides.

Anyone waiting for approval appears under Requests to join on the same page, and administrators receive a notification. This section only shows up when someone is actually waiting.

NoteNew members always land on a role without write or management permissions, even after approval. You can raise an individual person's access afterwards in Settings → Members. It's easier to grant more access later than to discover someone had too much all along.

Approve or deny a request

1. Go to Settings → Sign-in and find the request under Requests to join. Each entry shows who asked and when.
2. Choose an action:
   • Approve — adds the person as a member with the connection's default role.
   • Deny — turns the request away. Signing in again won't put them back in your queue; your decision stands until you invite them yourself.

WarningDenying a request is final until you personally send an invitation — the person cannot trigger another request just by signing in again.

Troubleshooting

Requests still arrive when your plan is full. You just can't approve one until a seat frees up. Trying to approve will tell you the member limit is reached, and the request stays in the queue so you can decide later, or free up a seat and come back to it.

What the person sees while waiting. They sign in successfully and keep whatever access they already had elsewhere. They simply aren't part of your organization until approved. If they had no account before, they get their own personal organization in the meantime, so they're never left with nothing to see.