Set how people join

Default role and team, allowed email domains, join links and the policies that limit them.

In short

Joining settings decide what a newcomer gets when nothing else chose it, which email domains may join on their own, and whether join links work. A join link lets anyone who has it join with the role and team it names.

Before you start

Who: "Change organization settings".
Plan: Organizations is part of every plan, Free included. Your plan sets how many members and teams an organization may hold (Plan & usage shows them).
First: decide the default role and team, and list the email domains your company uses. Public providers such as gmail.com are refused.

Steps

Open Settings › Joining.
Set the default role and default team, and the allowed email domains.
Each change saves itself a moment later; the line above the fields says "Saved". If a domain is refused, the line says why, and saving starts again when you correct it.

Under Joining, make sure "Allow join links" is on and saved.
Choose "New join link", then the role it grants, the team joiners land in, and optionally when it expires and how many uses it allows.
Choose "Create link" and "Copy link". It is shown in full only once.

Result: whoever opens the link sees the organization, role and team, signs in and presses "Join organization".

Save the allowed email domains first. Under "Domains people can join by", each saved domain shows whether it is proved.
An administrator presses "Prove" beside the domain and adds the TXT record shown, with its name and value copied exactly, at the company that runs the domain's DNS.
Press "Check now". A new record can take a few minutes to show.

Result: the domain shows "Proved", and people with a confirmed address there see the organization under "Colleagues already here" and can join. Listing a domain alone lets nobody in: anyone could list it. The record is read every day; if it goes missing, nobody new joins by that domain until it is back, and after a week the domain stops counting. Proving works on every plan, and the same proof serves single sign-on.

Good to know

The link list shows each link's prefix, role, team, uses, expiry and who created it.
"Revoke" stops a link at once and cannot be undone; make a new one.
A link also stops when its creator loses the right or leaves, or when the organization is archived.

A domain is a door, not a lock A proved domain lets matching people in. To refuse everyone else, turn on "Only allow members from the allowed email domains".

Anyone with the link can join A join link has no guest list. Prefer an expiry and a use limit, and revoke it when it has done its job.

If something goes wrong

A domain is refused: public mail providers such as gmail.com cannot be allowed.
Colleagues do not see the organization or cannot join: the domain is not proved yet, its record went missing, or another organization holds it. Settings › Joining says which.
A link stopped working: it expired, ran out of uses, was revoked, its creator lost the right, or join links were turned off.
Invitations to some people are refused: "Only allow members from the allowed email domains" is on.