Functionality of Invite Permissions feature

Summary

From this documentation, we can understand how to restrict Repository Admin from inviting users from other domains directly to a specific Repository which helps in enhancing the security of a workspace. 

Solution

We can overcome the above concern by enabling the Invite permissions option. The feature is available under Workspace Settings > Access controls

All members: This option allows both Repository and Workspace Admin to invite new users to the workspace

Having the option enabled when aRepository Admin invites a user to the workspace they are added as part of the "Default group" on the workspace. This allows the admins of the workspace an opportunity to review these users and add them to specific groups as required.

If you are a Workspace Admin, then users will directly get added to a specific group.

To limit the invite to a specific domain,

• Select All members, and click Add or Remove domains. Proceed by adding a domain. Example: gmail.com

  

• Now enable the option Restrict members sending invites to the following domains, and click UPDATE. Doing this will not allow the workspace members to invite users with the domain "gmail.com" to the workspace. 

  In this case, if a repo admin attempts to add a user to any repository from Repository Settings > User and group access with the domain "gmail.com" they should receive the following response and the process will be greyed out. However, this restriction is not applied to the Workspace Admin. Please note, that the Workspace Admin is allowed to invite users from any domain

  1 Workspace administrator has disallowed invitations to the domain: gmail.com