Okta and custom OAuth2 SSO configurations now use the verified-domain model, including organizations previously using temporary compatibility mode.
Existing linked members can continue signing in, and existing SSO enforcement still applies to organization members. Without a verified domain, the login page finds your provider only for existing members, automatic enrollment is paused, and SSO cannot create new accounts. Members with an unlinked account sign in to Tuist first and confirm the link; accounts created by your organization's SCIM provisioning retain their existing linking flow.
To enable domain-based discovery and configured automatic enrollment, open Settings → Authentication, publish the DNS TXT record shown for your login email domain, and click Verify domain. Keep the record published for daily verification checks. Google Workspace behavior is unchanged.
See the SSO verification guide for instructions.