Have the ability to disable the ability for users to create their own accounts under a domain

brianmandeville

It would be optimal for domain managers/admins to have the ability to disable users from being able to create their own accounts under that managed domain.

Ted Harris

@brianmandeville - you can easily enable SAML and link a SAML provider to manage who has and doesn't have access to create an account in Expensify with an email on your domain.

brianmandeville

yes, but the problem is users can still create their own accounts under that managed domain.

Stevie LaFortune

Welcome to the Community @brianmandeville! Great news - that is an option!

Domain Groups can be accessed if you have claimed and verified your domain. Groups are used to set rules or permissions for groups of users.

You can read more about the group settings in the attached Community post.

Deep Dive: Domain Groups and permissions — what are they all about?

brianmandeville

not what I am referring to, i am talking about user creation. I know with Groups I can restrict them from switching away.

The expensify login page still allows users to create their accounts under domains being managed and required with SAML.

Ted Harris

Ah, good point of clarification @brianmandeville you're right. Of course, they can't login to use that account at all though if you have SAML required.

What extra control does preventing this step of creating the account give you that having SAML enabled doesn't? Is it just that you don't like to see them in the list?

brianmandeville

When they create the account, they are logged in for that first time. And they can create Expense reports. Since we use Advanced Routing, setup routing for each individual user. Users think their report is pending, but in reality their account is not setup properly

Also, they will never be able to login again for a second time once logged out. Hence giving the ability to create accounts on SAML required domain is pretty pointless :)

Ted Harris

When they create the account, they are logged in for that first time

Hmm, this isn't quite correct if you have SAML enabled. When they click the validation link they're shown this:

After going "back" they then choose to login, when they're then redirected to their SAML provider. At that point, as long as they've not been allowed access to this app within the SAML provider, they will error upon login.

brianmandeville

That's not what I have been seeing on my instance. Users are getting in and creating expense reports.

Ted Harris

If that's the case, I think we'll need to dig in and figure out why! Could you message Concierge and reference this thread? It's likely we'll need you to test out a new user and show us this happening. FWIW, I just tested with our test accounts and there's no way I can get in when SAML is required.

brianmandeville

Possible there is a mobile app loophole?

Ted Harris

@brianmandeville that's a good question! I'll try to test that too shortly.

Ted Harris

@brianmandeville - you were right! Great spot - we're working on this now.