Your organisation sits above your 50heads teams. It proves which email domains belong to you, such as example.com, and lets you set rules for people whose email address is on them. Everything here is off until an admin turns it on.
We're turning organisations on gradually. If you don't see Organisation in your team's settings yet, it isn't on for your team. Contact us if you'd like it.
What an organisation is
Every team is part of an organisation. At first it's an organisation of one: your team. Everyone in the organisation's teams belongs to it, and the owners and admins of those teams are its admins.
Open it from Settings, then Organisation, while you're working in a team. Everyone in the team can see the organisation's name, its teams, its verified domains and its policies. Only admins can see the domain records and the activity log, and only admins can change anything.
Verifying a domain
Verifying proves that your organisation controls a domain. You do it by publishing a DNS record, which only someone who manages the domain can do.
- In Domains, enter the domain your email addresses use, such as example.com, and choose Add domain.
- 50heads shows a TXT record with a name and a value. The name looks like
_50heads-challenge.example.com, and the value starts with50heads-domain-verification=. Use the copy buttons, so nothing is mistyped. - Where you manage your domain's DNS (your registrar or DNS provider), add a TXT record with that name and value.
- Back in 50heads, choose Check now.
A new record usually shows within an hour, but it can take up to 48 hours. You can check again as often as you like, up to 30 times an hour for each domain.
Each domain is separate. Verifying example.com covers addresses like jo@example.com, not jo@mail.example.com; add a subdomain as its own domain. An organisation can list up to 20 domains.
Some domains can't be added, because no single organisation owns them: free email providers (such as gmail.com or outlook.com), shared endings (such as co.uk), throwaway email domains, and names with no public DNS.
What Check now can find
| Result | What it means | What to do |
|---|---|---|
| Verified | The record is there with the right value. | Nothing. Keep the record in place. |
| Record not found | There's no TXT record at the name shown. | Check the name, then wait a little and check again. |
| Different value | There's a TXT record at that name, but not with this value. | Copy the value again; it must match exactly. |
| Lookup didn't answer | The DNS lookup failed or timed out. Nothing changed. | Try again in a few minutes. |
| Held by another organisation | Another organisation has already verified this domain. | Only one organisation can hold a domain. Contact us if that's wrong. |
If you remove a domain and add it again later, it gets a new value, so you'll need to update the record.
The daily re-check and the 7-day grace
Keep the record published. We check every verified domain once a day.
- If the record is missing, the domain shows Record missing, and every admin gets an email. Its policies still apply for 7 days.
- Put the record back and choose Check now, or wait for the next daily check. The domain goes back to Verified.
- If it's still missing after 7 days, the domain shows Not verified and its policies stop applying. Admins get a second email. To verify it again, publish the record and choose Check now.
A lookup that fails on our side never counts as a missing record. Choosing Check now on a verified domain never makes it unverified.
Policies
Policies apply only to people whose verified email address is on a verified domain. All three are off until an admin turns them on, and you can only turn one on once a domain is verified.
- Auto-join. People whose verified email address is on your domain see a short notice when they sign in on the 50heads website, and can join your organisation's default team as a viewer. Admins can give them a different role later.
- Ask new people to come in through the organisation. Someone who tries to open a new personal account with an email address on your domain is refused, and told to ask an admin for an invitation. People with an invitation to one of your teams can still sign up. While auto-join is on, nobody is refused, because they can join you straight away.
- Claim with notice. Lets you ask people who already have personal accounts on your domain to move their work into the organisation, after a notice period of 7 to 90 days (30 by default). For now this saves your choice and the notice period; the notice itself isn't sent yet.
Single sign-on
Once a domain is verified, admins can also set up single sign-on, so people on it sign in with the account they use at work, through Okta, Microsoft Entra ID or Google Workspace. Admins can then make it the only way in for those addresses. We're rolling it out to organisations gradually. See Single sign-on for your organisation.
Provisioning and security policies
Admins can also let your identity provider, such as Okta or Microsoft Entra ID, add people to your teams, set their roles from their groups and remove them when they leave. This is called provisioning, and it uses SCIM. They can also set sign-in rules for everyone in your teams, such as requiring two-step sign-in. We're rolling these out to organisations gradually. See Provisioning and security policies.
Who can change these settings
Only an owner or admin of one of the organisation's teams can rename it, add, check or remove domains, or change policies. Every change needs a fresh check that it's you: choose Confirm it's you, and the check lasts 10 minutes. If you use two-step sign-in, it asks for your authenticator app, a passkey or a recovery code.
Organisation settings are on the website, signed in. Where your organisation has service accounts, an admin's API key or connected app with the organization:write scope can also add, check and remove domains and change policies, without the fresh check; so can a service account with that scope. The 50heads app can't change them.
What never happens to personal accounts
- A personal account is never deleted, merged or moved into your organisation without the person doing it themselves.
- Turning on a policy never changes an existing personal account.
- Someone who joins through auto-join keeps their own account, credits, questions and keys exactly as they are. Credits are the money you add to your 50heads balance to pay for answers.
- When a domain stops counting as verified, or is removed, nobody loses access. Only the policies stop.
The activity log
Activity lists who did what in the organisation, newest first: renaming it, adding, verifying and removing domains, failed checks, a record going missing or coming back, a domain no longer counting as verified, policy changes and people joining through auto-join. Changes made by our daily check show as made by 50heads. Entries can't be changed or deleted. Only admins can see the log.
Where the audit log is on for your organisation, Activity shows the latest few events with a link to the full audit log: every event of the organisation and its teams, with filters, JSONL and CSV exports, retention and legal holds.