This powerful feature allows companies to take greater control over user accounts with email addresses on a particular “domain” (eg, everything after the “@” in an email address). Domain Control feature is most often used by companies looking to centrally manage employees, or to centrally import company cards.

With domain control, you can:

  • Require strict adherence to policy workflows

  • Require strict enforcement of policy rules

  • Disable select features including login selection, policy creation and policy selection

  • Delete user accounts

  • Set multiple permission levels

  • Import company cards


Setting Up Domain Control

Step 1: Go to Admin > Domain Control and click “Get in control”.

Step 2: You will then need to verify ownership of this domain before continuing. You may need to consult your organization’s IT department to complete the verification process.

You have two very simple methods to verify your domain:

1. Host a File

2. Add a DNS Record

 Remove all other entries to your DNS TXT record before adding the verification code provided. You can then verify the domain ownership. After the verification you can remove the verification code and put back the original DNS txt information, if you deleted in the prior step. 


Managing Domain Control

Visit the Admin tab to manage Domain Control.

Domain Members Page

From the Domain Members page you can:

  • Add and delete user accounts.
  • Move users between permission groups.

As noted, Domain Control allows you to permanently deleted a user account (this action is not reversible). Any reports that they have submitted under that email address will be maintained, but they will no longer be able to access their account in Expensify. Any open (unsubmitted) reports, expenses and receipts will be deleted. To find reports from this user, you will need to filter by 'DELETED_0@user@domain.com'. E.g.: DELETED_0@amy@yourcompany.com.

Domain Admins Page

The Domain Admins page allows you to designate domain administrators. Domain administrators have the ability to edit Domain Control settings, and create new users via Domain Control or by inviting them to policies.

Expensify_-_Domain_Control_-_Domain_Admins.png

Groups Page

From this page you will be able to create permission groups and edit current permission group settings.

Here are what the different group permissions allow you to do and what you should expect with each of them:

Require strict adherence to policy workflows

Without strict enforcement of policy workflows, intermediary approvers will have the option of final approving a report. With this control enabled, only the final approver in the workflow will have the option of final approving a report.

Require strict enforcement of policy rules

This means that every rule that has been set for the policy will need to be satisfied in order for the report to be able to be submitted for approval. If there is a policy violation for that particular expense report, the employee will receive a "hard stop" and will be unable to submit the report. If you turn this feature off (which is the default), the employee will still get a warning dialogue but they will still be able to submit the report. 

Restrict primary login selection

This feature prevents users from being able to make a non-company domain email address their primary email address, thus bypassing permissions set up via Domain Control. 

Restrict expense policy creation/removal

This feature prevents users from being able to create new expense policies for the company or remove themselves from an existing policy. Often, this feature is used to prevent people from using Expensify to submit reports for use outside of the company domain when combined with strict policy enforcement.

Restrict primary policy selection

This feature is useful when you have groups of employees that only ever submit expense reports under one policy. This would allow, for example, an employee to only submit expense reports under Policy A, but could be an approver in Policy A and Policy B.

Delete user accounts

Domain Control allows you to centrally manage the process of removing an employee from Expensify. Any reports that they have submitted under that email address will be maintained, but they will no longer be able to access their account in Expensify. Any open (unsubmitted) reports, expenses and receipts will be deleted. To find reports from this user, you will need to filter by 'DELETED_0@user@domain.com'. E.g.: DELETED_0@amy@yourcompany.com.

Set multiple permission levels

This is helpful for managing different groups of users, such as employees, managers as well as administrators. 

To manage Domain Control groups:

Go to Admin > Domain Control > Select the domain you want to manage > Groups > Select a group > Edit

Anything that you choose in this edit screen will apply to all employees included in that group. You can see the list of employees for that respective group by clicking on "Show Members"

Company Cards Page

From this page, centrally administer company cards to specific employees.

Reconciliation

From this page, easily reconcile all unreported and/or reported expenses from specific date ranges.

Still need help?

Our friendly support team is here to help! Send us an email to help@expensify.com and we'll get back to you within 24 hours.