Your organization sits above your 50heads teams. It proves which email domains belong to you, such as example.com, and lets you set rules for people whose email address is on them. Everything here is off until an admin turns it on.

We're turning organizations on gradually. If you don't see Organization in your team's settings yet, it isn't on for your team. Contact us if you'd like it.

What an organization is

Every team is part of an organization. At first it's an organization of one: your team. Everyone in the organization's teams belongs to it, and the owners and admins of those teams are its admins.

Open it from Settings, then Organization, while you're working in a team. Everyone in the team can see the organization's name, its teams, its verified domains and its policies. Only admins can see the domain records and the activity log, and only admins can change anything.

Verifying a domain

Verifying proves that your organization controls a domain. You do it by publishing a DNS record, which only someone who manages the domain can do.

  1. In Domains, enter the domain your email addresses use, such as example.com, and choose Add domain.
  2. 50heads shows a TXT record with a name and a value. The name looks like _50heads-challenge.example.com, and the value starts with 50heads-domain-verification=. Use the copy buttons, so nothing is mistyped.
  3. Where you manage your domain's DNS (your registrar or DNS provider), add a TXT record with that name and value.
  4. Back in 50heads, choose Check now.

A new record usually shows within an hour, but it can take up to 48 hours. You can check again as often as you like, up to 30 times an hour for each domain.

Each domain is separate. Verifying example.com covers addresses like jo@example.com, not jo@mail.example.com; add a subdomain as its own domain. An organization can list up to 20 domains.

Some domains can't be added, because no single organization owns them: free email providers (such as gmail.com or outlook.com), shared endings (such as co.uk), throwaway email domains, and names with no public DNS.

What Check now can find

Result What it means What to do
Verified The record is there with the right value. Nothing. Keep the record in place.
Record not found There's no TXT record at the name shown. Check the name, then wait a little and check again.
Different value There's a TXT record at that name, but not with this value. Copy the value again; it must match exactly.
Lookup didn't answer The DNS lookup failed or timed out. Nothing changed. Try again in a few minutes.
Held by another organization Another organization has already verified this domain. Only one organization can hold a domain. Contact us if that's wrong.

If you remove a domain and add it again later, it gets a new value, so you'll need to update the record.

The daily re-check and the 7-day grace

Keep the record published. We check every verified domain once a day.

  • If the record is missing, the domain shows Record missing, and every admin gets an email. Its policies still apply for 7 days.
  • Put the record back and choose Check now, or wait for the next daily check. The domain goes back to Verified.
  • If it's still missing after 7 days, the domain shows Not verified and its policies stop applying. Admins get a second email. To verify it again, publish the record and choose Check now.

A lookup that fails on our side never counts as a missing record. Choosing Check now on a verified domain never makes it unverified.

Policies

Policies apply only to people whose verified email address is on a verified domain. All three are off until an admin turns them on, and you can only turn one on once a domain is verified.

  • Auto-join. People whose verified email address is on your domain see a short notice when they sign in on the 50heads website, and can join your organization's default team as a viewer. Admins can give them a different role later.
  • Ask new people to come in through the organization. Someone who tries to open a new personal account with an email address on your domain is refused, and told to ask an admin for an invitation. People with an invitation to one of your teams can still sign up. While auto-join is on, nobody is refused, because they can join you right away.
  • Claim with notice. Lets you ask people who already have personal accounts on your domain to move their work into the organization, after a notice period of 7 to 90 days (30 by default). For now this saves your choice and the notice period; the notice itself isn't sent yet.

Single sign-on

Once a domain is verified, admins can also set up single sign-on, so people on it sign in with the account they use at work, through Okta, Microsoft Entra ID or Google Workspace. Admins can then make it the only way in for those addresses. We're rolling it out to organizations gradually. See Single sign-on for your organization.

Provisioning and security policies

Admins can also let your identity provider, such as Okta or Microsoft Entra ID, add people to your teams, set their roles from their groups and remove them when they leave. This is called provisioning, and it uses SCIM. They can also set sign-in rules for everyone in your teams, such as requiring two-step sign-in. We're rolling these out to organizations gradually. See Provisioning and security policies.

Who can change these settings

Only an owner or admin of one of the organization's teams can rename it, add, check or remove domains, or change policies. Every change needs a fresh check that it's you: choose Confirm it's you, and the check lasts 10 minutes. If you use two-step sign-in, it asks for your authenticator app, a passkey or a recovery code.

Organization settings are on the website, signed in. Where your organization has service accounts, an admin's API key or connected app with the organization:write scope can also add, check and remove domains and change policies, without the fresh check; so can a service account with that scope. The 50heads app can't change them.

What never happens to personal accounts

  • A personal account is never deleted, merged or moved into your organization without the person doing it themselves.
  • Turning on a policy never changes an existing personal account.
  • Someone who joins through auto-join keeps their own account, credits, questions and keys exactly as they are. Credits are the money you add to your 50heads balance to pay for answers.
  • When a domain stops counting as verified, or is removed, nobody loses access. Only the policies stop.

The activity log

Activity lists who did what in the organization, newest first: renaming it, adding, verifying and removing domains, failed checks, a record going missing or coming back, a domain no longer counting as verified, policy changes and people joining through auto-join. Changes made by our daily check show as made by 50heads. Entries can't be changed or deleted. Only admins can see the log.

Where the audit log is on for your organization, Activity shows the latest few events with a link to the full audit log: every event of the organization and its teams, with filters, JSONL and CSV exports, retention and legal holds.