Access & Login Security

This page is where you configure how users sign in, which email domains are auto-joined into your workspace, and whether Microsoft Entra groups sync with your meinGPT teams.

You find it under Settings → Access. It is only visible to workspace admins.

Allowed email domains

Users who register with an email on a verified domain are added to your workspace automatically. This replaces one-by-one invitations and at the same time keeps employees from spinning up their own trial accounts on the company email.

Add and verify a domain

Click Add domain and enter e.g. yourcompany.com. The domain starts in status Unverified — auto-join is still off.
The verification dialog shows a Host, a Type (TXT), and a Value. Add this entry to the DNS configuration of your domain.
Back in meinGPT, click Check now. DNS entries usually propagate within 5 minutes — if the check fails immediately, wait a moment and retry.
After a successful check, the domain switches to Verified, and new registrations with that email suffix are auto-joined from then on.

Suggested domains: If members with a particular email domain are already in the workspace, meinGPT proactively suggests it ("X members already use this domain"). You can accept the suggestion with a click, but still need to publish the DNS TXT entry before auto-join kicks in.

Add existing users retroactively

When you click the "Apply to existing users" icon on a verified domain, meinGPT lists every person outside this workspace who already has an email on that domain. You can add them all as viewers in one step. Existing memberships in other workspaces are untouched.

Remove a domain

Removing a domain stops auto-join — existing memberships are not removed. If you add the domain back later, you have to re-verify it via DNS TXT.

Recommendation

Add domains early so employees don't spin up parallel trial workspaces on the company domain in the meantime.

Custom domain (white-label)

You can reach your workspace from your own hostname, e.g. chat.yourcompany.com instead of app.meingpt.com. This is a paid add-on and is set up together with our team.

A custom domain is useful when:

you want to present meinGPT to your employees under your own brand
you want a stable company URL in onboarding material and internal communications
your SSO security policy requires avoiding third-party hostnames

What happens during setup (together with our team):

DNS entry on your side (CNAME or A-record pointing to our endpoint)
TLS certificate on our side via Let's Encrypt
Microsoft and Google SSO use our central callback address; new custom domains no longer need separate OAuth redirect URIs
origin allow-list updated on our backend for CORS and Stripe redirects

To start the conversation: open Access & Login Security → Custom domain in workspace settings and click "Contact sales", or email enterprise@meingpt.com directly.

Authentication methods

This is where you decide which methods users can use to register and sign in to your workspace. Three methods are available — all three are enabled by default:

Email (magic link) — passwordless sign-in via a one-time link sent to the user's email
Google — sign-in via Google account (particularly handy for Google Workspace customers)
Microsoft — sign-in via Microsoft account (personal, school, or work). Works without any further configuration; an Entra setup is not required for this — see the next section if you additionally want to sync groups.

At least one method must stay enabled — meinGPT prevents you from disabling the last one.

Below the toggles you find a pre-generated login URL of the form app.meingpt.com/auth?login=microsoft,email. It lists the currently enabled methods as URL parameters. Visitors who open this link only see the pre-selected options on the sign-in page — other methods stay hidden.

Typical use: hand a Microsoft-only link to your workforce so employees don't accidentally create a parallel account via magic link on their personal address. The URL updates automatically as you toggle methods on or off.

Entra ID sync

If you use Microsoft Entra ID (formerly Azure AD), you can link Entra groups to your meinGPT teams. Memberships are then applied automatically — removing someone from the Entra group also removes them from the meinGPT team.

This section only appears once your workspace is enabled for Entra sync. Reach out to us if you don't see it and need it.

One-time authorization

Click Authorize. A Microsoft popup opens asking for admin consent on your tenant — this step must be performed by someone with Microsoft admin rights.
Once consent is granted, meinGPT stores the tenant ID. No separate manual configuration is needed.

Enable group synchronization

The switch next to the section title controls whether Entra groups are actually synced. On first activation or after tenant changes, meinGPT may require a re-authorization — the banner "Re-authorization may be required" indicates this. In that case, just click Re-authorize again.

Which Entra group is wired to which meinGPT team is configured in team settings afterwards (see Team management → Entra sync).

Restrict access additionally on the Microsoft side

If you want to limit meinGPT access to specific Entra groups, that's done on the Microsoft side via Conditional Access: block the "meinGPT" application for everyone and explicitly grant access to the chosen groups. This complements the authentication toggles in meinGPT but does not replace them.