Add organization domains and finish SSO setup

Available on: Web admin portal for administration; Mac, Windows, iOS and Android for SSO sign-in.

Link your company email domains to the right Flow organization, verify ownership by DNS, and connect SSO so eligible teammates can join and sign in.

Request domain changes

Adding, changing or removing domains requires Wispr assistance; the portal lists linked domains read-only. Each active domain belongs to one organization, and matching is exact — list every domain separately, since mail.example.com is not covered by example.com. Capitalization and surrounding spaces do not affect matching.

Warning: Removing a domain hides it from settings, stops automatic joining for that domain and removes it from your SSO configuration. You cannot remove the last active domain. Re-adding or restoring a domain is safe to repeat.

Sign in to the Flow admin portal with an organization admin account for the organization you want to manage — the signed-in account determines which organization you manage.
Email enterprise@wispr.ai with the complete domain list, the organization name and its admin email, your identity provider if you are setting up SSO, and why you are changing domains (rebrand or acquisition, replacing or removing a domain, consolidating organizations, plus any domains planned for later). No domain-count limit is published; support can confirm any restrictions.
Follow any verification or sales-assistance instructions provided for your organization.
Wait for confirmation before testing affected users.

Adding or removing domains updates the active domains in an existing SSO configuration. If that update fails, the Flow change still applies; support can retry the SSO update.

Restricted or sales-assisted domains

A domain already owned by another organization cannot be added. Supply a non-empty domain; support must resolve any availability-check failure before adding it.

Educational, government, military and treaty-organization domains — including .edu, .gov, .mil, .int, .ac.in and country variants such as .gov.uk and .edu.au — require assistance unless pre-approved. Pre-approval applies to the exact public or country-variant domain, not to separate university or free-email restrictions, so do not assume an exception. University restrictions can apply to exact domains with other endings, and free or disposable email domains, including their subdomains, cannot normally be attached as company domains.

The web portal shows Cannot create organization with a public domain for restricted domains. Commercial domains can separately require sales-assisted onboarding; send the exact domain and message to support, your sales or customer-success representative, or talk to sales.

Verify domain ownership

Organization admins verify linked domains in organization settings. Non-admin members cannot view verification status.

Select Start verification, or Continue verification for an unfinished check. The TXT value is shown only while the domain is unverified.
Publish the DNS TXT record at _wispr-verify.<domain> with the exact value wispr-verify=<token> provided by Flow. Tokens do not expire, and support cannot bypass the exact DNS TXT match.
Select Check verification. Success shows Domain verified successfully. If you see TXT record not found yet. Try again in a minute., check the value and retry manually — checks are not automatic, and DNS changes can take an hour or longer.

SSO can only attach verified domains.

Finish the SSO connection

Note: SSO setup requires the Enterprise plan and an Admin, SuperAdmin or IT Admin role; other members cannot use the controls. Lower plans show a disabled SSO / SAML Authentication row reading Upgrade to Enterprise plan to use this feature instead of Configure SSO.

SSO setup does not register domains. It attaches only registered, DNS-verified domains and excludes older unverified ones; if none are verified, an existing SSO link is reused. Continue from a saved identity-provider configuration rather than starting over.

Open Settings → Organization → User management → SSO / SAML Authentication.
Choose Configure SSO (new), Finish setup (in progress), or Manage SSO (connected).
Follow the identity-provider instructions in the separate setup portal window.
Configure the SAML application and assign the users or groups that should have access.
Complete test authentication if offered.
Select Refresh beside Changed your SSO configuration? Refresh your SSO connection. in Flow. Success shows Single sign-on is active., Manage SSO and Enforce SSO for all members. Flow also checks once per organization load, so the connection may already appear.

If you deleted or replaced your identity-provider connection, refreshing also clears the old one, so sign-ins route to the new connection.

Warning: Enforcing SSO blocks other sign-in methods for covered email domains; communicate the change first. Enforcement requires active billing and does not block sign-in if the domain or organization cannot be identified, or if an unexpected error prevents the check.

Members can use SSO without enforcement. Enable Enforce SSO for all members only if required; it appears only after SSO becomes active. Configure SCIM is separate and stays disabled until SSO is connected and active — see SCIM provisioning for directory setup.

Test member access

Confirm a user with each exact email domain can join and sign in. Members enter their full work email address for SSO; sign-in from an identity-provider dashboard also works.

Mac and Windows: Select Sign in via browser.
Android: Select Continue with SSO.
iOS: Select More Options → Continue with SSO.

Note: A linked domain alone does not guarantee automatic joining — organization membership, automatic-add settings and billing conditions also apply, and exact-domain mismatches, seat caps or membership in another organization can prevent it. SCIM-managed organizations skip domain-based joining; IT must add users through the identity provider. Linking a domain never changes account emails or merges individual account data.

SSO setup is unfinished or the connection fails

Setup failures show Failed to set up SSO. Please try again. Connection failures show Unable to connect to your SSO provider. Check your SSO configuration and try again.

Confirm the provider configuration belongs to the same organization and includes a linked, verified domain.
Complete remaining portal instructions using Finish setup when the connection is inactive.
Select Refresh again. Stop when Flow shows Single sign-on is active. A completed connection can also be recognized during sign-in without a manual refresh.

If the domain is already linked to another organization in the SSO configuration, contact support.

A member is directed to another sign-in method

Sign-in problems show an explanatory page. When sign-in started in a browser, the page includes a Back to login button; desktop and iOS sign-ins usually do not.

SSO Requires Being A Part Of An Organization means the email's exact domain is not linked to an organization. Use another sign-in method or contact your administrator, and ask support to confirm the exact domain is linked to the intended organization.

Your Organization Has Not Configured SSO requires an admin to finish the connection using the recovery steps above.

If the email domain is not allowed or invited, the page explains the account was not invited to that organization — whether the person used SSO, Google, Apple or Microsoft sign-in. Ask your administrator to invite the account or link the domain; if accounts are managed through directory sync, ask IT to add the account.

Use the displayed account method unless your organization requires SSO, in which case the SSO redirect takes precedence; ask IT to resolve an enforcement mismatch. Organizations can restrict sign-in to members only while billing is active; unexpected errors leave sign-in allowed.

Other access restrictions

After too many sign-in attempts, wait before retrying; repeated attempts can prolong the wait.

Your network isn't allowed is a separate restriction that blocks access even with valid SSO credentials. Use an approved network or VPN and follow network access troubleshooting; changing a domain does not bypass the allowlist. On desktop and iOS, the blocked screen offers Retry and Sign Out — retry after switching to an approved network, since retrying from a disallowed network blocks again.

Still need help?

Contact support if a domain conflicts with another organization, or if access still fails after verification and connection checks. Send the organization name, full domain list, affected email address, identity provider, platform and device, the exact error, and the steps you tried.