AdministrationUser access

Create and manage domains for your Organization

Authorization policies in Astro are based on email domains, which ensures that all users with an approved email domain authenticate with a specific authentication method. Domains can be mapped to single sign-on (SSO) methods so that users who have an email with a domain are automatically directed to your SSO platform when they sign in to Astro.

You can only configure a single domain for an SSO connection. However, if you have multiple managed domains, then you can set up multiple different SSO connections, with a separate SSO connection for each domain.

A new Astro UI is here

Astronomer has redesigned the Astro UI. Try the new experience and switch your instructions using the New Astro UI and Legacy UI tabs on this page. Your selection is remembered across the docs.

Create a domain

  1. In the Astro UI, go to Settings, then in the Security section, click Authentication.
  2. Click + New Managed Domain.
  3. In the Domain field, enter the domain that you want to map.
  4. Click Create Managed Domain. The domain is added to your managed domains and marked as Unverified.
  5. In the entry for your domain, click Verify Domain. A new window appears with steps to verify your domain.
  6. Follow the steps to verify your domain. If you can’t complete the steps yourself, contact the administrator for your domain and ask them to complete the steps instead.
  7. Click Verify Domain to notify Astro to check your DNS record.
Typically, a change in the DNS record takes only minutes to propagate; however, there are cases where it may take up to 72 hours.

After your domain is verified, you can map the domain to an SSO connection. Mapping a domain ensures that all users with the same email address domain have the same authentication experience when they sign in to Astro. You can later use this mapping to enforce specific sign in methods for users with emails from a specific domain. See Configure SSO.

Delete a domain

  1. In the Astro UI, go to Settings, then in the Security section, click Authentication.
  2. Next to the domain you want to delete, click the trash bin.
  3. Follow the prompts to confirm the deletion.