How do I route logins by email domain?

Who can do this

Owner or Admin

Auth rules decide what happens when a user types their email at the sign-in screen — go to SSO, go to password, or offer both. They're matched by the email domain.

Steps

1. Open Settings → Security.
2. Scroll to Auth Rules.
3. Click Add Rule.
4. Fill in:
   • Domain — e.g. acme.com or contractors.acme.com.
   • Method — sso, password, or all.
   • Provider types (only when method is sso) — pick one or more IdPs to allow.
5. Click Save.

Result

When a user signs in with an email matching the rule:

• sso — they're redirected to the chosen IdP. The Console password screen is never shown.
• password — they go straight to the password screen, even if SSO is configured.
• all — they see a chooser with both options.

Order matters

Rules are evaluated top-to-bottom, longest-domain-first. A rule for contractors.acme.com wins over a rule for acme.com when both match.

Related

• How do I configure SSO?