What Is an Authoritative Domain?
In the Authentication Settings Domains section, you can register and verify one or more domains that your organization owns. This allows your users to sign in with Single Sign-On (SSO) using their email addresses (e.g., firstname.lastname@mycompany.com).
When multiple tenants register the same domain, only one of them can be marked as the Authoritative Domain. This designation matters because:
The Authoritative Domain is the only one allowed to enforce policies like Password Requirements or Multi-Factor Authentication (MFA).
It acts as the primary source of truth for identity verification and domain ownership.
All logins tied to that domain will respect the Policy settings defined by the Tenant having the Authoritative Domain.
Why This Matters
This setup prevents conflicting policies and ensures your users experience consistent, secure authentication — even if multiple teams or business units are using the same domain in different parts of our ecosystem.
How to Claim an Authoritative Domain
Register and verify your domain under Authentication Settings > Domains.
You will see if the Domain is Authoritative or not in your Domains overview.
If your domain has already been claimed by another tenant, you can request to Claim Authoritative Domain through the provided workflow to take authoritative ownership of the domain.
An email will be sent to the Administrators in the other Tenant asking them to Sign-In to Authentication Settings to review your Transfer request.
Once approved by an Administrator in the other Tenant, the Domain will follow your policy settings like password policy.
How to Accept Transfer of an Authoritative Domain
For the organization that has been sent a transfer request they will have to review it and Accept or Deny the Transfer.
Once the Transfer request has been accepted or denied an email is sent to the Administrators in the other Tenant informing them if their Transfer request was accepted or denied.
Impacts of Accepting the Transfer
Your authentication policies for this domain will no longer be enforced.
Domain ownership verification remains, but policy control will transfer.
You can still allow users to log in, but using the other tenant's policies.
Only the new authoritative tenant can make security-related domain changes.
Once approved the Domain will instantly follow the policy settings like password policy of the other Organization.