Skip to main content

Invite a domain user

Creating a mailbox creates a person's identity on your domain. You never set, see, or send their password: the new user chooses their own credentials through a welcome link.

1. Create the domain user​

Create the domain user under Domain Accounts. The panel shows a welcome card once, with:

  • the welcome link for the new user
  • a PIN and a claim address, for when the full link is inconvenient to send. The user enters the PIN together with their email address.
Copy the card before you leave the page

The panel doesn't store the card and can't show it again. If you lose it, or the link expires after 72 hours, reset the user's credentials on their domain account page for a new link.

2. Pass it on​

Send the link over a channel you trust: chat, an email address the person already has, or in person. The same goes for the claim address, email address, and PIN.

Treat the link as a credential

The link is single-use. The first person to open and complete it owns the domain account.

3. What the user does​

The link takes the user to the sign-in portal on your domain, where they:

  1. choose a password, or a passkey, which removes passwords entirely;
  2. enroll in two-factor authentication, if your settings require it;
  3. fill in their name and profile.

From then on they manage everything in the portal: password changes, passkeys, two-factor authentication, app passwords for mail clients, active sessions, and connected apps. The mail setup page there shows how to connect their apps.

Where you come back in​

You never handle a user's credentials, but Domain Accounts keeps you in control:

  • apply an authentication policy
  • review sessions and access logs
  • reset credentials, which issues a new welcome link
  • lock the domain account if an attacker compromises it

See Manage domain users and Your domain users for the full picture.