Security settings
Verify your email domains, decide how colleagues join and how they sign in, set up Microsoft Entra ID, connect your identity provider through SCIM, and test whether your network allows live voice conversations.
Open Settings → Security to verify domains and choose how colleagues join and sign in. Run the connection test here if voice conversations fail.
Owners and Admins can use this page.
Domains and access
Add and verify a domain
Verify an email domain to enable join requests, automatic joining or SSO.
- Go to Settings → Security.
- Click Add domain.
- Enter your email domain, for example
example.com. - Click Continue.
- Copy the TXT Value.
- Add it as a TXT record in your DNS settings.
- Click Verify now.
The DNS record looks like this:
| Type | Host | Value |
|---|---|---|
| TXT | @ for example.com, app for app.example.com | sleak-verification=<token> |
Use the exact value shown in the dialog. When Sleak finds the record, the domain shows as Verified.
Tip
No access to your DNS settings? Open Don't have access to DNS settings? in the dialog. Copy the pre-filled email with Copy email and send it to whoever manages your DNS.
A new DNS record can take a few minutes to become visible. If Sleak can't find it yet, click I'll verify later. The domain stays in the list as Pending verification. Click Verify next to it once the record is in place. Show DNS record shows the value again.
Decide how colleagues join
Choose the joining method for verified domains under How colleagues join. The default is Invite only. Changes require a verified domain and apply immediately.
How colleagues join
Invite only
Only invited people join.
Request access
People with your domain ask to join. An Admin approves.
Auto-join
People with your domain join as Members.
Remove a domain
- Click the trash icon next to the domain.
- Confirm with Remove domain.
If no verified domain is left, Sleak resets How colleagues join to Invite only. While Microsoft Entra ID is the login method, you can't remove the last verified domain.
Choose the login method
Sign-in methods shows the active method and available connections.
| Option | Sign-in |
|---|---|
| Magic link | A one-time sign-in link by email. |
| Password | Email address and password. |
| Microsoft Entra | Microsoft work account. Setup is described below. |
| Google account. Sleak configures it. | |
| SAML 2.0 | Your identity provider. See SSO to connect and test it. |
Activate beside Magic link or Password opens a confirmation. Switch confirms the change for the next sign-in.
How Sleak picks the sign-in
A person enters their email address, and Sleak works out the sign-in from their workspaces:
- Colleagues are members whose email domain is a verified domain of the workspace. They sign in with the workspace's login method.
- Externals are members whose email domain is not verified there, for example freelancers or trainers. In a workspace with Microsoft, Google or SAML they sign in with a magic link, but only when Allow external sign-in is on. Otherwise they ask the admin for access.
- Several workspaces: Sleak picks the strongest method they need, in this order: Microsoft, Google, SAML, magic link, password. A workspace that needs a different sign-in asks them to sign in again when they open it.
- No membership yet: If their domain is verified in a workspace, they sign in with its method and then join or request access, depending on How colleagues join. If the workspace is invite only, they read that they should ask their admin for an invitation.
- No workspace at all: Sleak sends no email and creates no account.
A sign-in with Microsoft opens a workspace only when the Microsoft account belongs to the tenant the workspace is bound to.
Set up Microsoft Entra ID
You need a verified domain. Your own email domain must be verified for the test.
- Click Set up next to Microsoft Entra.
- Copy the approval link with Copy link for IT.
- Send the link to your IT admin. It lasts 14 days and requires no Sleak account.
- Have your IT admin approve Sleak in the Microsoft tenant.
- Click Sign in with Microsoft to test the connection.
- Click Activate.
- Confirm with Switch.
Activation signs out members with verified domains. Your own session stays. The test binds the tenant to the workspace. Contact Sleak before changing tenants.
Good to know
Sleak uses a ready-made enterprise app. You do not manage metadata or certificates. The requested permissions are
openid, profile, email, offline_access and User.Read.
Allow external authentication
With Allow external sign-in, members whose email domain is not verified in the workspace sign in with a magic link. This applies to workspaces with Microsoft, Google or SAML. Invite these people as usual.
Sleak rejects invitations outside verified domains when the switch is off. The invitation dialog shows a warning.
Manage access to Sleak in Entra
You can control who may use Sleak in two ways.
| Way | Setting in Entra | Who gets in |
|---|---|---|
| In Sleak | Assignment required? set to No | Everyone in your tenant may sign in. Invitations and How colleagues join decide who gets in. |
| In Entra | Assignment required? set to Yes, and a group such as "Sleak Users" under Users and groups | Only the assigned users and groups may sign in. |
You find both settings in the Microsoft Entra admin center under Enterprise applications → Sleak → Properties and Users and groups.
- Conditional Access and MFA: Your Conditional Access policies apply to Sleak like to every other app. Sleak does not ask for a second factor itself.
- Block sign-in: Set Enabled for users to sign-in? to No under Properties. Nobody in your tenant can then sign in to Sleak.
User provisioning (SCIM)
Your identity provider can manage the members of your workspace through SCIM. See User provisioning (SCIM).
Connection test
Test the connection if voice conversations fail or audio quality is poor.
- Go to Settings → Security.
- Under Connectivity & Firewall, click Run connection test.
- Allow microphone access if requested.
- Wait for the result.
Optimal connection
Best audio quality.
Nothing to do.
Connection works
Audio works, direct UDP connection not confirmed.
If there are problems, Copy report for IT.
Degraded connection
Audio works with noticeably higher latency.
Open UDP 50000 to 60000 outbound.
Connection blocked
No connection.
Copy report for IT and have the firewall rules opened.
If only the microphone check fails, the browser or the input device is the cause, not the firewall.
If the microphone check fails, the cause is not your firewall. Check that your browser may use the microphone and that the right input device is selected.
Tip
Click Copy report for IT and send the report to your IT team. It contains all results and the firewall rules.
Firewall rules
Share these rules with your IT team. All of them are outbound.
| Destination | Port | Purpose |
|---|---|---|
app.sleak.ai | TCP 443 | Sleak web app |
*.livekit.cloud | TCP 443 | Signaling (WebSocket) |
*.turn.livekit.cloud | TCP 443 | Relay over TLS |
*.host.livekit.cloud | UDP 3478 | Relay over UDP |
| Any host | UDP 50000 to 60000 | Audio, main path |
| Any host | TCP 7881 | Audio, fallback over TCP |
If your network inspects SSL traffic, it must allow WebSocket upgrades (HTTP 101) to *.livekit.cloud and app.sleak.ai.
Good to know
- Domain changes, the join setting, the login method, every step of the Microsoft setup and the external authentication switch are recorded in the audit log.
- The firewall rules and the IT report are in English.
- The same domain can be verified in more than one workspace.
Related articles
Last updated on 14 November 2026