Skip to main content

Domain users

A domain user is a person you give an identity on your domain. Their email address identifies them and is also their sign-in.

You never handle a domain user's credentials

A new user sets their own credentials through a single-use welcome link. A reset works the same way.

Create a domain user​

Open Email & Identity → Accounts, select the domain, choose Create, and select the User type. The same screen offers groups, forwarders, and other address types, but only a user is a full sign-in identity.

A user needs two things:

  • a username, the local part of their email address and their sign-in: ada on example.com gives [email protected]
  • a name to show on the account

Optionally, add the user to groups or write an internal note for yourself. The user sets up everything else: password, passkey, two-factor authentication, and profile.

The welcome card is shown once

On save, the panel shows a single-use welcome link, with a PIN as a fallback. The new user claims the account with it and chooses their own credentials.

Copy the card before you leave the page: the panel doesn't store it and can't show it again.

Invite a domain user has the full procedure and how to hand the link to the user.

What a domain user can reach​

A domain user's sign-in is an OpenID Connect identity, not tied to one service: it's single sign-on across everything you offer on the domain:

  • Webmail in the browser.
  • Email, calendar, and contacts in desktop and mobile apps, over standard protocols. Where the client supports it, the user signs in with OAuth.
  • File shares and other services on your domain that ask for a password.
  • Your own applications. Register them under the identity provider, and your domain users can sign in to them.

Domain users in teams​

A group is a shared address, e.g. [email protected], whose members are domain users. It does three jobs at once:

  • mail to the group reaches each member's mailbox
  • a member can send as the group
  • the group can decide who gets into a restricted website or a section of your own application

Membership is set on the domain user, so one edit on a person's page changes what they receive, what they can send as, and what they can open.

What a domain user can do themselves​

From their sign-in portal, a domain user can, without you:

  • change their password, or drop passwords and use passkeys
  • enroll in two-factor authentication, with an authenticator app and backup codes
  • create an app password for a client that can't sign in through a browser
  • see and revoke their own active sessions and connected apps
  • edit their profile: name, language, time zone, and contact details
note

A security-sensitive step, such as adding a passkey, asks the user to confirm their identity first, so an unattended signed-in screen can't be used to take over the account.