Skip to content

Managed Domains#

Managed Domains is how you bring every Lens user on your company's email domain under your Lens Business ID. The primary purpose is Domain Capture for licensing compliance — ensuring that employees who sign up for Lens with a company email are automatically associated with your organization and consume a seat from your subscription, rather than continuing to use personal or free licenses outside your control.

From this page you can also add and verify domains. Once a domain is verified, you can configure SSO/SCIM for users on it.

Prerequisites#

  • An active Lens Pro or Lens Enterprise subscription.
  • Lens Business ID Administrator permissions.

Add a domain#

Click Add Your Domain and enter the domain in the dialog. The domain appears in the table with the Unverified status.

Note

Only apex domains are supported (for example, example.com). Subdomains and public email providers such as gmail.com are not allowed.

Verify a domain#

Info

To verify your email domain, contact the support team. They will help you complete the domain verification.

After a domain is verified, you can:

Domain Capture#

What it does#

Domain Capture ensures that all Lens users with an email address under your verified domain are automatically associated with your Lens Business ID. This removes the need to invite employees individually, keeps every user under your enterprise subscription, and closes the license-compliance gap created when employees sign up with personal or team licenses outside your organization. For guidance on who needs a license, see the Eligibility FAQ.

Domain Capture runs on every sign-in, so it captures both brand-new sign-ups and existing Lens users on your domain — not only users created after enablement.

What gets enabled#

Domain Capture is currently enabled by the Lens team on your behalf. When you request enablement, the Lens team schedules a date with you and turns on the following for your Lens Business ID:

  • Domain Capture for the verified domain — all users with an email address on that domain are automatically associated with your Lens Business ID the next time they sign in.
  • Your custom message — users without an assigned license see the message you provide, directing them to your internal license-request process. See Custom message for blocked users.
  • Removal of existing free licenses — any existing Lens Personal or Lens Team licenses held by users on your domain are removed as part of enablement. Those users keep their Lens ID and account data; only their license status changes.

Info

Self-service enable/disable for Domain Capture is on the roadmap. Until then, contact the Lens team to enable or disable the feature.

What end users experience#

New users signing up for Lens with an email on your domain:

  1. Complete the standard Lens sign-up process.
  2. Are automatically associated with your Lens Business ID as a Member.
  3. If Automatic Seat Assignment is enabled and a seat is available, they receive one immediately. Otherwise, they see your custom message directing them to your license-request process.

Existing users with free Personal or Team licenses on your domain, after enablement:

  • Are associated with your Lens Business ID.
  • Have no active license until one is assigned through your procurement process.
  • On their next sign-in, experience the same flow as a new user — they see your custom message and are directed to the contact you specified.
  • Do not lose their Lens ID or account data. Only their license status changes.

Existing users already in your Lens Business ID with an assigned seat continue using Lens as normal. Nothing changes for them.

Users with SSO configured on the domain are redirected to your identity provider as usual. Domain Capture and SSO work together in the same sign-in flow.

Communicate the change before enablement

Existing free-license users on your domain will experience an interruption in Lens access until a license is assigned to them through your internal process. We recommend announcing the change internally before the Lens team enables Domain Capture so affected users know what to expect and how to request a license.

Custom message for blocked users#

The custom message is shown to every user on your domain who does not have an assigned seat — including existing free-license users whose licenses were removed during enablement. Use it to direct employees to your internal software procurement or license-request process.

If no custom message is configured, a default message asks the user to follow their organization's internal process or contact an administrator. Plain text or markdown is supported, up to 500 characters.

Example custom message

As an Acme employee, you will need to obtain a license through Acme's software asset management process. Please contact workstationsoftwaremanagement@acme.com for further instructions.

Once the custom message has been initialized by the Lens team during enablement, administrators can update it themselves from the admin console at any time. The new message takes effect on the next sign-in.

Captured users and the Managed Domains table#

Users added through Domain Capture have a managed membership:

  • They cannot leave the organization on their own. The Leave Organization action is disabled in the UI and rejected by the API.
  • A Managed badge appears next to the organization in the user's organization list.

The Managed Domains table shows an Uncaptured Users count for each domain — existing Lens users whose email matches the domain but who have not yet been captured. They are captured the next time they sign in.

Enabling or disabling Domain Capture, and automated user joins, are recorded in the audit log. Automated joins are attributed to an IDP actor to distinguish them from manual admin actions.

Tip

For the strongest onboarding control, combine Domain Capture with SSO/SCIM so every user on your domain is both associated with your organization and authenticated through your identity provider.