A managed organization can prove that an email domain belongs to it, then let its members sign in with their organization ID: a school digital workspace (ENT), Microsoft Entra ID, Google Workspace, Keycloak or any OpenID Connect provider. Everything is set up in the admin console › “Sign-in” (the “Security and sign-in” page), with the “Manage security” permission.
Verify a domainLink to the Verify a domain section
- Admin console › “Sign-in” › “Domains” card › “Add a domain”.
- Enter the domain of your addresses, for example
school.fr, then click “Add”. - Moon AI shows a TXT record: its “Record name” is
_moonai.followed by your domain, and its “Record value” starts withmoonai-verification=. - Add this record to the domain’s DNS, then click “Check”. The domain then shows “Verified on” followed by the date.
Domains of public email services (Gmail, Outlook…) cannot be verified, and neither can a domain already verified by another organization. Verification is repeated regularly: if the record disappears, the domain is no longer considered verified.
A verified domain lets you:
- manage the accounts of this domain (see Member accounts);
- create their accounts through single sign-on or the SCIM directory;
- require the organization’s sign-in;
- use automatic joining, if you turn it on.
Removing a domain removes no members: its accounts no longer join the organization on their own, and the organization’s sign-in no longer applies to them.
Domain settingsLink to the Domain settings section
“Settings” on the domain’s row:
- “Auto-join”: an account of this domain with a verified address joins the organization the next time it signs in, as long as seats are left. Not available while the organization pays by card: each account would add a billed seat.
- “Default role”: never the admin role.
- “Default groups”: chosen from the groups whose members are picked by hand.
“Existing accounts” lists the Moon AI accounts already created with an address on the domain. Choose the ones to invite: each person gets an email and joins the organization when they accept.
Connect your identity providerLink to the Connect your identity provider section
What you need from your providerLink to the What you need from your provider section
Create an OpenID Connect application of the “web” type (with a secret), and give it the redirect address shown by Moon AI:
https://chat.realmoon.ai/api/v1/orgs/sso/callbackWrite down the issuer address, the client ID and the client secret.
| Provider | Issuer address |
|---|---|
| Microsoft Entra ID | https:// |
| Google Workspace | https:// |
| Keycloak | https:// |
| School ENT or other provider | The issuer given by its administrator, over https |
An address ending in / is also accepted.
Set up the sign-inLink to the Set up the sign-in section
- Admin console › “Sign-in” › “Organization sign-in (SSO)” card.
- Enter the “Identity provider URL”, the “Client ID” and the “Client secret”.
- Click “Test”: Moon AI checks that the provider responds (“The provider responded. … signing keys found.”).
- Turn the sign-in on, then click “Save”.
Moon AI then shows the “Organization sign-in link”, to share with your members: it opens sign-in with your provider directly.
Advanced settingsLink to the Advanced settings section
| Setting | Default | Purpose |
|---|---|---|
| “Scopes” | openid | The information requested from the provider. openid is always added. |
| “Email claim” | email | The claim that gives the address. Providers usually only confirm the email claim: with another claim, sign-in is refused. |
| “Name claim” | name | The display name. If missing, the first name and last name. |
| “Groups claim” | empty | Optional. When empty, the provider’s groups are not read. |
| “Provider groups” | none | Each mapping links a provider group to an organization group. |
| “Trust email addresses from this provider” | off | Some providers mark addresses as unverified, and every sign-in is then refused. Turn this option on only if your users cannot change their own address at your provider. |
With provider groups, a member joins the chosen group at each sign-in, and leaves it once they are no longer in it at the provider. A group that grants the admin role cannot be chosen.
Who can sign in this wayLink to the Who can sign in this way section
- Without a verified domain: the organization’s members and invited people sign in with their own address, whatever its domain. Nobody else can.
- With a verified domain, or a provider served on your domain: any address on that domain can sign in. A Moon AI account is created at first sign-in if the person does not have one, and they join the organization as long as seats are left.
- The organization’s owner never signs in through single sign-on: they keep their password and their other sign-in methods.
If the person’s Moon AI account has two-factor authentication, its code is requested after the provider step.
Require the organization’s sign-inLink to the Require the organization’s sign-in section
With at least one verified domain, “Require SSO” forces accounts on your verified domains to sign in through your provider: their password and other sign-in methods are refused. Sessions opened any other way are closed.
- The owner keeps their password.
- Admins keep their other sign-in methods, so they never lose access to the admin console if the provider goes down.
“Remove sign-in” gives everyone back their password and other methods, and deletes the client secret.
For membersLink to the For members section
- On the sign-in page, choose “Continue with my organization’s SSO”.
- Enter “Your work or school email”.
- Sign in at your provider: you come back to Moon AI, in the organization.
The organization’s sign-in link opens this sign-in directly. In the mobile apps, the provider’s page opens in the phone’s browser, then takes you back to the app.
If the organization requires its sign-in, a password sign-in shows this message, in French: Votre (your organization asks you to sign in with its ID; choose “Continue with my organization’s SSO”).
Error messagesLink to the Error messages section
These messages are shown in French.
| Message | Meaning | What to do |
|---|---|---|
La | The sign-in expired or was already used. | Start the sign-in again from the beginning. |
Votre | Your address is not on a domain verified by this organization. | Use your organization address, or ask for an invitation. |
Votre | Your address is not in this organization yet. | The organization has no verified domain: you need an invitation. |
Le | The identity provider did not confirm your email address. | The admin checks the address at the provider, or the “Trust email addresses from this provider” option. |
Le | The provider does not confirm the address read from the claim your organization chose. | The “Email claim” must be email. |
Ce | This account cannot sign in with an organization ID. | It is the owner’s account: it signs in with its password. |
La | Your organization’s sign-in is not active. | The admin must test the sign-in, then turn it back on. |
Le | Your organization’s identity provider did not respond correctly. | Try again; if it keeps happening, the admin checks the setup. |
See alsoLink to the See also section
- Member accounts, to require two-factor authentication and limit session length
- SCIM directory
- Domains and Single sign-on (OpenID Connect) in the Organizations API