Skip to main content

Sign-up Approval Workflow

Users who self-register with email + password on the web require tenant-admin approval before they can use your tenant.

The Flow​

  1. User registers at /signup (email domain routes them to your tenant) and verifies their email with a one-time code (OTP).
  2. Their membership enters pending approval state — they can't work in the tenant yet, and land on /pending-approval.
  3. A tenant admin reviews the request under Admin → Users → Pending Approvals.
  4. Approve — the membership is activated, and the user is notified by email.
  5. Reject — the request is denied, and the user is notified by email.

Re-approval​

If a member was later disabled, they can raise a re-approval request; it appears for tenant admins to approve or reject, restoring their access when approved.

Notes​

  • Microsoft SSO web users are auto-approved when their Azure directory matches your registered entraDirectoryId; otherwise they fall back to email-domain trust.
  • Teams users are linked automatically on first sign-in.
  • The designated first admin for a tenant is auto-approved and promoted, so a brand-new tenant has someone to approve everyone else.
  • After approval, grant the user project roles so they can participate in work — see Projects & Members.

:::note Approving an organization vs a user This page is about approving users into an existing tenant. Approving a new organization's self-serve registration is a separate, platform-admin task — see Tenants & Platform Admin. :::