Team Accounts Stay on the Company’s Own Domain

Many companies get their first admin account from the platform when a trial is opened, set up with a placeholder email. When the partnership becomes real, that account needs to move to the person who is actually responsible, but the email in the account profile was read-only. The admin could not change it and had to ask someone else to do it.

Making the field editable was simple. Holding email changes to the same rule as invitations took more care. Companies with a registered domain can only invite addresses on that domain, a rule the invitation flow already enforced; if email changes used a separate check, the two rules would sooner or later disagree.

An email change now reuses the exact check that invitations use: the same decision about which company a user belongs to, the same domain match. For companies with a domain policy, the new address must be on the registered domain or one of its subdomains, and anything else is rejected with an error that says why. Other tenants and platform users are unaffected. Changing the registered domain itself still follows its time window, but email changes caused by staff turnover remain allowed after that window closes, because that is the everyday case.

In the portal, the email field is now editable, with a note that it is the sign-in address and must use the company domain, and the new address survives a page refresh and is used for the next sign-in. Because both rules share one check, they cannot drift apart when either one is adjusted later.