This powerful feature allows companies to take greater control over user accounts with email addresses on a particular “domain” (i.e., everything after the “@” in an email address). Domain Control feature is most often used by companies looking to centrally manage employees, or to centrally import company cards.

With domain control, you can:

  • Require strict adherence to policy workflows

  • Require strict enforcement of policy rules

  • Disable select features including login selection, policy creation and policy selection

  • Delete user accounts

  • Set multiple permission levels

  • Import company cards

  • Utilize Automatic Statement Reporting


Setting Up Domain Control

Check out the video below or use the screenshots and information below to get started with Domain Control.

Step 1: Go to Admin > Domain Control and click “Get in control”.

Step 2: You will then need to verify ownership of this domain before continuing. You may need to consult your organization’s IT department to complete the verification process.

You have two very simple methods to verify your domain:

1. Host a File

2. Add a DNS Record

 Remove all other entries to your DNS TXT record before adding the verification code provided. You can then verify the domain ownership. After the verification you can remove the verification code and put back the original DNS txt information, if you deleted in the prior step. 


Managing Domain Control

Visit the Admin tab to manage Domain Control.

An Important Note About Migrating to Domain Control

If you are a policy admin who has been inviting employees to Expensify, when your company migrates to Domain Control there is a slight change in the permissions that you will need in order to be able to invite employees. Since Domain Control creates additional restrictions on who can create and delete users, you'll need to be a Domain Admin in addition to being a Policy Admin. In order to be made a Domain Admin, an existing Domain Admin will need to add you to Admin > Domain Control > [select domain] > Domain Admins > Add Admin.

If you're unsure of who is a Domain Admin at your company, we'll provide a helpful message the next time you attempt to invite a new employee to a policy:

 

Domain Members Page

From the Domain Members page you can:

  • Add and delete user accounts.
  • Move users between permission groups.

As noted, Domain Control allows you to permanently deleted a user account (this action is not reversible). Any reports that they have submitted under that email address will be maintained, but they will no longer be able to access their account in Expensify. Any open (unsubmitted) reports, expenses and receipts will be deleted. 

Domain Admins Page

The Domain Admins page allows you to designate domain administrators. Domain administrators have the ability to edit Domain Control settings, and create new users via Domain Control or by inviting them to policies. The Primary Contact will be the point-of-contact for issues within this domain and must be a Domain Admin .

Expensify_-_Domain_Control_-_Domain_Admins.png

Groups Page - Set Rules and Permissions

From this page you will be able to create permission groups and edit current permission group settings. The video below will explain in greater detail, or use the screenshots below for help.

 

Here are what the different group permissions allow you to do and what you should expect with each of them:

Require strict adherence to policy workflows

Without strict enforcement of policy workflows, intermediary approvers will have the option of final approving a report. With this control enabled, only the final approver in the workflow will have the option of final approving a report.

Require strict enforcement of policy rules

This means that every rule that has been set for the policy will need to be satisfied in order for the report to be able to be submitted for approval. If there is a policy violation for that particular expense report, the employee will receive a "hard stop" and will be unable to submit the report. If you turn this feature off (which is the default), the employee will still get a warning dialogue but they will still be able to submit the report. 

Restrict primary login selection

This feature prevents users from being able to make a non-company domain email address their primary email address, thus bypassing permissions set up via Domain Control. 

Restrict expense policy creation/removal

This feature prevents users from being able to create new expense policies for the company or remove themselves from an existing policy. Often, this feature is used to prevent people from using Expensify to submit reports for use outside of the company domain when combined with strict policy enforcement.

Restrict primary policy selection

This feature is useful when you have groups of employees that only ever submit expense reports under one policy. This would allow, for example, an employee to only submit expense reports under Policy A, but could be an approver in Policy A and Policy B.

Delete user accounts

Domain Control allows you to centrally manage the process of removing an employee from Expensify. Any reports that they have submitted under that email address will be maintained, but they will no longer be able to access their account in Expensify. Any open (unsubmitted) reports, expenses and receipts will be deleted. 

Set multiple permission levels

This is helpful for managing different groups of users, such as employees, managers as well as administrators. 

To manage Domain Control groups:

Go to Admin > Domain Control > Select the domain you want to manage > Groups > Select a group > Edit

Anything that you choose in this edit screen will apply to all employees included in that group. You can see the list of employees for that respective group by clicking on "Show Members"

Company Cards Page

From this page, centrally administer company cards to specific employees. The following video will explain how to do this. 

 

Automatic Statement Reporting

You have the ability to auto-create reports for all company card transactions in a given statement period by enabling the Automatic Statement Reporting feature. This function automatically places all expenses in a given period onto a report so your employees don't have to, and emails them a reminder when their expenses are due! All they have to do is submit. The video below will explain how to do this easily. 

Loading Dock 

From this page, easily reconcile all unreported and/or reported expenses from specific date ranges. You can also run also run a travel itinerary report that reports on travel bookings for employees across our various travel integrations.

SAML

Expensify offers single-sign on via SAML 2.0. Under domain control, read more about this feature on our help page for single sign-on.

Still need help?

Our friendly success team is here to help! Send us an email to help@expensify.com and we'll get back to you within 24 hours.