Domain capture is a feature that blocks users in your domain from creating a Read AI account unless they are invited to join your workspace. This helps ensure that everyone in your organization who is using Read AI belongs to your workspace and, as a result, follows the same default settings, permissions, and policies that you've configured for your workspace.
Domain capture is only available to Enterprise+ customers, and can be enabled from your workspace settings.
How domain capture works
There are two different ways that domain capture can be implemented with Read AI. This article describes the more basic method; however, if you are also using SAML with Read AI, you should read Enforcing SAML for users in your domain. With both methods, you will need to first verify your ownership of the domain(s) you want to capture.
The basic version of domain capture prevents users from creating new accounts unless they've been invited to join your workspace. Once invited, they'll receive an email with a link to create their account, and when they do, they will automatically be added to your workspace.
Without an invitation, anyone whose email domain matches one of your verified domains will receive an error when they try to create an account:
Pre-existing accounts in your domain(s) can continue using Read AI without any impact, unless you enable the Block Non-Workspace Domain Accounts setting (more details below).
Domain capture with SAML
If you have SAML enabled, there's an additional setting you can turn on for a version of domain capture that works with SAML. The setting is called Enforce SAML on Verified Domains. To learn more, see Enforcing SAML for users in your domain.
In addition to letting you manage who should and shouldn't be allowed to create a Read AI account, it will automatically block pre-existing users in your domain from logging in to Read AI if they aren't authorized via SAML.
Other ways to bring people into your Workspace
- Workspace join requests: People with an email address on your domain can ask to join your Workspace, and an admin approves or declines each request. See Workspace Join Requests.
- SCIM provisioning: If you manage users in an identity provider like Okta or Microsoft Entra ID, SCIM adds and removes people from your Workspace automatically. See Managing users and teams with SCIM provisioning.
How to enable domain capture
Prerequisites
To turn on domain capture, you'll need:
- A Read AI workspace with the Enterprise+ subscription
- Verified ownership of the domain(s) you want to capture
- Someone who is an admin in your workspace
Step-by-step instructions
- Have a Workspace admin open Workspace Settings and expand the Advanced (Enterprise+ Plan Required) section.
-
Make sure you've added and verified every domain you want to capture users from, based on their email address.
-
Turn on Enable Domain Capture. Note: If you use SAML and turn on Enforce SAML on Verified Domains, that setting takes priority over Enable Domain Capture.
-
Auto-join: Decide whether to turn on auto-join. When it's on, anyone who signs up or signs in with an email address on one of your verified domains is added to your Workspace automatically. This option only appears once domain capture is on.
-
Block Non-Workspace Domain Accounts: Decide whether to block accounts on your domain that aren't in your Workspace. This applies domain capture to accounts created before you turned it on. This option only appears once domain capture is on.
-
Auto-charge: Decide whether to turn on license auto-charge. If new users join after you've used all your licenses, Read automatically bills you for the extra licenses.