Add organization domains and finish SSO setup

Last updated: November 10, 2026

Available on: Web admin portal for administration; Mac, Windows, iOS and Android for SSO sign-in.

Link your company email domains to the right Flow organization, verify ownership by DNS, and connect SSO so eligible teammates can join and sign in.

Request domain changes

Adding, changing or removing domains requires Wispr assistance; the portal lists linked domains read-only. Each active domain belongs to one organization and matching is exact, so list every domain separately — mail.example.com is not covered by example.com. Capitalization and surrounding spaces do not affect matching.

Warning: Removing a domain hides it from settings, stops automatic joining for that domain and removes it from your SSO configuration. You cannot remove the last active domain. Re-adding or restoring a domain is safe to repeat.

  1. Sign in to the Flow admin portal with an organization admin account — the signed-in account determines which organization you manage.

  2. Email enterprise@wispr.ai with the complete domain list (including domains planned for later), the organization name and its admin email, your identity provider if you are setting up SSO, and the reason for the change — rebrand or acquisition, replacing or removing a domain, or consolidating organizations. No domain-count limit is published; support can confirm any restrictions.

  3. Follow any verification or sales-assistance instructions provided for your organization.

  4. Wait for confirmation before testing affected users.

Adding or removing domains updates the active domains in an existing SSO configuration. If that update fails, the Flow change still applies; support can retry the SSO update.

Restricted or sales-assisted domains

A domain already owned by another organization cannot be added. Supply a non-empty domain; support must resolve any availability-check failure before adding it.

Educational, government, military and treaty-organization domains — including .edu, .gov, .mil, .int, .ac.in and country variants such as .gov.uk and .edu.au — require assistance unless pre-approved. Pre-approval applies to the exact public or country-variant domain only: university restrictions can apply to exact domains with other endings, and free or disposable email domains, including their subdomains, cannot normally be attached as company domains.

The web portal shows Cannot create organization with a public domain for restricted domains. Commercial domains can separately require sales-assisted onboarding; send the exact domain and message to support, your sales or customer-success representative, or talk to sales.

Verify domain ownership

Organization admins verify linked domains in organization settings. Non-admin members cannot view verification status.

  1. Select Start verification, or Continue verification for an unfinished check. The TXT value is shown only while the domain is unverified.

  2. Publish the DNS TXT record at _wispr-verify.<domain> with the exact value wispr-verify=<token> provided by Flow. Tokens do not expire, and support cannot bypass the exact DNS TXT match.

  3. Select Check verification. Success shows Domain verified successfully. If you see TXT record not found yet. Try again in a minute., check the value and retry manually — checks are not automatic, and DNS changes can take an hour or longer.

Finish the SSO connection

Note: SSO setup requires the Growth or Enterprise plan and an Admin, SuperAdmin or IT Admin role; other members cannot use the controls. On plans without SSO, the SSO / SAML Authentication row is disabled instead of showing Configure SSO.

SSO setup does not register domains. It attaches only registered, DNS-verified domains and excludes older unverified ones; if none are verified, an existing SSO link is reused. Continue from a saved identity-provider configuration rather than starting over.

  1. Open Settings → Organization → User management → SSO / SAML Authentication.

  2. Choose Configure SSO (new), Finish setup (in progress), or Manage SSO (connected).

  3. Follow the identity-provider instructions in the separate setup portal window.

  4. Configure the SAML application and assign the users or groups that should have access.

  5. Complete test authentication if offered.

  6. Select Refresh beside Changed your SSO configuration? Refresh your SSO connection. in Flow. Success shows Single sign-on is active., Manage SSO and Enforce SSO for all members. Flow also checks once per organization load, so the connection may already appear.

If you deleted or replaced your identity-provider connection, refreshing also clears the old one, so sign-ins route to the new connection.

Warning: Enforcing SSO blocks other sign-in methods for covered email domains; communicate the change first. Enforcement requires active billing and does not block sign-in if the domain or organization cannot be identified, or if an unexpected error prevents the check.

Members can use SSO without enforcement, so enable Enforce SSO for all members only if required; it appears only after SSO becomes active. Configure SCIM stays disabled until SSO is connected and active.

Test member access

Confirm a user with each exact email domain can join and sign in. Members enter their full work email address for SSO; sign-in from an identity-provider dashboard also works.

  • Mac and Windows: Select Sign in via browser.

  • Android: Select Continue with SSO.

  • iOS: Select More Options → Continue with SSO.

When someone signs in with SSO, Google, Apple or Microsoft, any pending invite is accepted and domain-based joining is applied during sign-in, so the person is a member as soon as they reach the app. If your plan charges per seat, that membership can add a seat at the same moment.

Note: A linked domain alone does not guarantee automatic joining — organization membership, automatic-add settings and billing conditions also apply, and exact-domain mismatches, seat caps or membership in another organization can prevent it. Organizations managed through directory sync skip domain-based joining; IT must add users through the identity provider. Linking a domain never changes account emails or merges individual account data.

SSO setup is unfinished or the connection fails

Setup failures show Failed to set up SSO. Please try again. Connection failures show Unable to connect to your SSO provider. Check your SSO configuration and try again.

  1. Confirm the provider configuration belongs to the same organization and includes a linked, verified domain.

  2. Complete remaining portal instructions using Finish setup when the connection is inactive.

  3. Select Refresh again. Stop when Flow shows Single sign-on is active. A completed connection can also be recognized during sign-in without a manual refresh.

If the domain is already linked to another organization in the SSO configuration, contact support.

A member is directed to another sign-in method

Sign-in problems show an explanatory page. When sign-in started in a browser, the page includes a Back to login button; desktop and iOS sign-ins usually do not.

SSO Requires Being A Part Of An Organization, or on Android SSO isn't available for this email. Try another sign-in method, or contact your administrator if your company uses SSO., means the email's exact domain is not linked to an organization with SSO. Use another sign-in method, and ask support to confirm the exact domain is linked to the intended organization or have an admin finish the SSO connection.

Your Organization Has Not Configured SSO requires an admin to finish the connection using the recovery steps above.

Verified Email Required means the Microsoft, Google, Apple or SSO account used has no verified email address. On iOS and Android, select Return to Wispr Flow to return to the app and sign in another way; verify an email address with the identity provider, or ask IT to add one, before retrying.

If the email domain is not allowed or invited, the page explains the account was not invited to that organization — whether the person used SSO, Google, Apple or Microsoft sign-in. Ask your administrator to invite the account or link the domain; if accounts are managed through directory sync, ask IT to add the account.

Use the displayed account method unless your organization requires SSO, in which case the SSO redirect takes precedence; ask IT to resolve an enforcement mismatch. Organizations can restrict sign-in to members only while billing is active; unexpected errors leave sign-in allowed.

Other access restrictions

After too many sign-in attempts, wait before retrying; repeated attempts can prolong the wait.

Your network isn't allowed is a separate restriction that blocks access even with valid SSO credentials. Use an approved network or VPN; changing a domain does not bypass the allowlist. On desktop and iOS, the blocked screen offers Retry and Sign Out — retry only after switching to an approved network, since retrying from a disallowed network blocks again.

Still need help?

Contact support if a domain conflicts with another organization, or if access still fails after verification and connection checks. Send the organization name, full domain list, affected email address, identity provider, platform and device, the exact error, and the steps you tried.