---
title: Configure organizational domains
slug: opti-id/docs/configure-organizational-domains
docTags: 
createdAt: 2026-07-30T20:38:23.419Z
---

Opti ID uses your organization's Domain Name System (DNS) domains to enable just-in-time (JIT) user onboarding.

In Opti ID, you can configure your organization's DNS domains so that a user can log in if they have an email whose domain matches any of the configured domains for your organization, even if the user was not explicitly provisioned from user management in the Opti ID Admin Center.

:::hint{type="warning"}
**Important**
Only add domains that your organization owns.

Adding collaborator, social, or any other domains that your organization does not own can incorrectly redirect users who are not actually affiliated with your organization to your Opti ID single sign-on (SSO) login.
:::

## Prerequisites

- Must have admin access in Opti ID.
- You cannot use [System for Cross-domain Identity Management (SCIM)](docId\:ru8-TYzLixv0lgnmqp7XN).
- Configure the SAML or OIDC single sign-on (SSO) connection in your identity provider (IdP):
  - [Configure SAML SSO with Entra ID](docId\:XhMGgM6XcnSe9jx5cNiZc)
  - [Configure SAML SSO with Okta](docId\:Oj8VPZBzJ5zBWPh-uEbPC)
  - [Configure SAML SSO with PingOne](docId\:UYykMSVSd1ShUitxwnCjY)
  - [Configure OIDC SSO with Entra ID](docId\:ARv4NskeO_S86B0flcRAl)
  - [Configure OIDC SSO with Okta](docId\:zEhzcCx-GyLdTFFp1Ty_k)
  - [Configure OIDC SSO with PingOne](docId\:ijq-LACcH856cYdSqbYGw)
- (Optional) Sync groups from your IdP to Opti ID.
  - [Sync groups from Entra ID](docId\:CrV3exfC2hccinhGyFiRT)
  - [Sync groups from Okta](docId\:xaW2h7nxIeq4BE5ZWU6g7)
  - [Sync groups from PingOne](docId\:dLvT_kEM1Kdzn9aQG16_m)

## Configure DNS domains

1. Log in to your organization's Opti ID home dashboard ([https://login.optimizely.com](https://login.optimizely.com/)).
2. Go to **Admin Center > Settings > Domains/Dynamic Provisioning**.
3. Click **Add SSO Domains**, select the SSO connection, and enter your organization's DNS domains. If you configure more than one domain for an SSO connection, separate them with commas, and ensure you enter only domains your organization owns.

   ![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/Ki7Y8KzSvmu1yjczD4P6F-20260720-145957.png)

   :::hint{type="warning"}
   **Important**
   Do not configure social domains such as hotmail.com, gmail.com, facebook.com, and so on. Also, do not configure domains belonging to external organizations that you may have a relationship with, such as agencies or partnerships. If users in your organization use email addresses with social domains or domains belonging to external organizations, you must explicitly provision them from the user management page in the Admin Center.
   :::
4. Click **Save**. This configures the DNS domains for your organization, and users with email addresses whose domains match any of the ones configured can log in to Opti ID without first being explicitly provisioned. You will still need to provision users in groups for product access.

   ![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/hi9OOuOJTJsOJlLdbtGcm-20260720-145957.png)

## Social Domains

The following social domains are blocked. Attempting to add them returns an error.

- facebook.com
- gmail.com
- icloud.com
- me.com
- yahoo.com
- hotmail.com
- linkedin.com