> ## Documentation Index
> Fetch the complete documentation index at: https://docs.speckle.systems/llms.txt
> Use this file to discover all available pages before exploring further.

# Domain Protection

> Secure who can access your workspace

<Note>Domain protection is available on paid plans.</Note>

Domain protection lets you control who can access your workspace by limiting it to users with specific email domains.

### Enable domain protection

Admins can enable domain protection under Settings -> Security.
Workspace members can see this section, but only workspace admins can change these controls.
In Settings -> Security, this control appears in the **Domain protection** section.

<Steps>
  <Step title="Connect verified domains to workspace">
    Domain protection works by connecting one or more verified domains to the workspace. Add these from the top of the Security settings page.

    The email domain you used when signing up to Speckle will already be verified, so you can add it as a verified domain to your workspace with a single click (unless you signed up with Gmail, Outlook, or another standard email provider).

    To connect additional domains to your workspace, first verify more emails in your [email settings](https://app.speckle.systems/settings/user/emails) (avatar menu -> User settings -> Emails). Any emails you verify there will show up as available domains you can connect to your workspace.
  </Step>

  <Step title="Enable domain protection">
    Enable domain protection with the toggle switch on the Security settings page.
  </Step>
</Steps>

<Info>
  If your organization uses the [SSO](/workspaces/sso) feature, you don't need
  to also enable domain protection.
</Info>

### When domain protection is enabled

1. Admins cannot invite new members whose email isn't from the verified domains list.
2. Users with the Guest role can still join the workspace even if their email doesn't match any verified domains, since this role is designed for external collaborators.