Post #2630832
2026-05-12 17:21 UTC
@ghostwriter@phpc.social Yeah. That's kind a what I do already. But it's interesting that that info seems to be nowhere found....
Or let me rephrase that: All infos I found so far were starting *after* that verification.
And that really becomes a mess when I think of entra allowing guest-accounts with totally not under the control of the domain email-addresses 🤯
Ah well....
Replies (2)
-
@heiglandreas@phpc.social 2026-05-12 17:24
@ghostwriter@phpc.social Oh and... How do I know whether the OP is actually validating that domain? So I have to check the domain-validation every time I send someone at login to that OP.... And I have to recheck the domain validation on every change to the OP config...
-
@ghostwriter@phpc.social 2026-05-12 17:24
@heiglandreas@phpc.social you're right about that. It's scattered across multiple specs and best-practice documents rather than stated as one clean "here's how to trust an OP for a domain" rule.