> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trylaunchkit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Domains and enforcement

> Verify email domains, route sign-ins, and enforce SSO workspace-wide

## Claiming an email domain

Verified domains power the **Continue with SSO** button: a member enters their email on the login page, LaunchKit matches the domain to your workspace, and redirects to your IdP.

<Steps>
  <Step title="Claim">
    In the workspace console open **Workspace, then Security**, and add your domain (for example `acme.com`). Public email domains (gmail.com, outlook.com, and similar) cannot be claimed.
  </Step>

  <Step title="Add the DNS TXT record">
    The page shows a **record host** and **record value** for a DNS TXT challenge. Create that record at your DNS provider.
  </Step>

  <Step title="Verify">
    Click **Verify**. Distinct failure states (record not found, value mismatch, lookup failed) are reported so you can tell propagation delay from a typo. Once verified, the domain routes sign-ins to your connection.
  </Step>
</Steps>

<Note>
  A domain can be verified by **one workspace globally**. If verification reports the domain as already owned by another organization and you believe it is yours, contact LaunchKit support.
</Note>

## Enforcing SSO

Enforcement refuses password sign-in for the entire workspace; every member must come through your IdP.

Before you can turn it on:

* The connection must be **enabled**.
* **You** must have signed in through this SSO connection at least once. This proves the connection works before it becomes the only door.

When you turn it on:

* Every other member's session is revoked immediately; they sign in again through the IdP. Your own session survives.
* Any later change to an IdP field (issuer, client ID or secret, SAML entity ID, sign-on URL, certificate, protocol) **automatically drops enforcement** in the same save, so a broken IdP config cannot lock the workspace out.

<Warning>
  There is no self-service break-glass for an enforced workspace. If your IdP is misconfigured or unreachable and nobody can sign in, recovery is performed by LaunchKit support. Test the connection thoroughly before enforcing, and re-verify after every IdP-side change.
</Warning>

## Provisioning interplay

* **JIT only**: first SSO sign-in creates the member with the connection's default role.
* **With SCIM**: your directory creates, updates, and deactivates members ahead of sign-in; JIT still fills any gap. See [Directory sync](/en/scim/overview).