[Yandex Cloud documentation](../../../index.md) > [Yandex Identity Hub](../../index.md) > [Step-by-step guides](../index.md) > Managing user pools > Setting up a domain in a user pool

# Managing domains in a user pool


A [domain](../../concepts/domains.md) allows you to authenticate through the [Login Discovery](../../concepts/domains.md#login-discovery) system. When authenticating, a user with your domain will be redirected to your [user pool](../../concepts/user-pools.md).

## Associating a domain {#add}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization) using an administrator or organization owner account.
  1. In the left-hand panel, click ![userpool](../../../_assets/organization/userpool.svg) **User pools** and select the user pool.
  1. In the top-right corner, click **Add domain**.
  1. Enter the domain name.
  1. Click **Add**.

  To use the domain to add new users, have it [verified](validate-domain.md).

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command to associate a domain with a user pool:

     ```bash
     yc organization-manager idp userpool domain add --help
     ```

  1. Run this command:

      ```bash
      yc organization-manager idp userpool domain add <pool_ID> <domain>
      ```

      Result:

      ```text
      done (1s)
      domain: example. com
      status: NEED_TO_VALIDATE
      status_code: organization/domain-diagnostics#need-to-validate
      created_at: "2025-10-09T06:40:18.704791371Z"
      validated_at: "1970-01-01T00:00:00Z"
      challenges:
      - created_at: "2025-10-09T06:40:18.704791371Z"
      updated_at: "2025-10-09T06:40:18.704791371Z"
      type: DNS_TXT
      status: PENDING
      dns_challenge:
      name: _yandexcloud-challenge. example. com
      type: TXT
      value: TlHc5HKJDeQIgPqaoiiSXxgy3CWFD+MLMJJP********
      ```

      Save the `value` as you will need it to [validate the domain](validate-domain.md).

- API {#api}

  Use the [Userpool.AddDomain](../../idp/api-ref/Userpool/addDomain.md) REST API method for the [Userpool](../../idp/api-ref/Userpool/index.md) resource or the [UserpoolService/AddDomain](../../idp/api-ref/grpc/Userpool/addDomain.md) gRPC API call.

{% endlist %}

## Verifying a domain {#validate}

You can use only verified domains to add users.

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization) using an administrator or organization owner account.
  1. In the left-hand panel, click ![userpool](../../../_assets/organization/userpool.svg) **User pools** and select the [user pool](../../concepts/user-pools.md).
  1. Select the domain you need to verify.
  1. In the section that opens, you will see the details you will need to pass the domain rights check.
  1. After completing the verification, click **Confirm**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.  

  1. Confirm that the domain belongs to you:

     1. Go to the DNS records management section on your domain's DNS provider's website:
     1. Add a TXT record with the following parameters:

        * **Host** or **Subdomain**: `_yandexcloud-challenge`.
        * **Text** or **Value**: The `value` field value you got after [associating the domain](add-domain.md).

     1. Wait for the DNS records to update. The update may take up to 72 hours.

  1. See the description of the CLI command for validating your domain in a [user pool](../../concepts/user-pools.md):

     ```bash
     yc organization-manager idp userpool domain validate --help
     ```

  1. Run this command:

      ```bash
      yc organization-manager idp userpool domain validate <pool_ID> <domain> \
        --name <domain>
      ```

      For example, validate `my-domain.ru` in `my-federation`:

      ```bash
      yc organization-manager federation saml validate-domain my-federation \
        --domain my-domain.ru
      ```

- API {#api}

  Use the [Userpool.ValidateDomain](../../idp/api-ref/Userpool/validateDomain.md) REST API method for the [Userpool](../../idp/api-ref/Userpool/index.md) resource or the [UserpoolService/ValidateDomain](../../idp/api-ref/grpc/Userpool/validateDomain.md) gRPC API call.

{% endlist %}

## Getting a list of domains {#list}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization) using an administrator or organization owner account.
  1. In the left-hand panel, click ![userpool](../../../_assets/organization/userpool.svg) **User pools**.
  1. Select the pool from the [user pool](../../concepts/user-pools.md) list.
  1. Under **Domains**, you will see a list of all available domains.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for getting a list of [domains](../../concepts/domains.md) in a [user pool](../../concepts/user-pools.md):

     ```bash
     yc organization-manager idp userpool domain list --help
     ```

  1. Run this command:

      ```bash
      yc organization-manager idp userpool domain list <pool_ID>
      ```

- API {#api}

  Use the [Userpool.ListDomains](../../idp/api-ref/Userpool/listDomains.md) REST API method for the [Userpool](../../idp/api-ref/Userpool/index.md) resource or the [UserpoolService/ListDomains](../../idp/api-ref/grpc/Userpool/listDomains.md) gRPC API call.

{% endlist %}

## Viewing information about a domain {#get}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization) using an administrator or organization owner account.
  1. In the left-hand panel, click ![userpool](../../../_assets/organization/userpool.svg) **User pools**.
  1. Select the required pool from the [user pool](../../concepts/user-pools.md) list.
  1. Under **Domains**, click the [domain](../../concepts/domains.md) name.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for viewing information about a [domain](../../concepts/domains.md) in a [user pool](../../concepts/user-pools.md):

     ```bash
     yc organization-manager idp userpool domain get --help
     ```

  1. Run this command:

      ```bash
      yc organization-manager idp userpool domain get <pool_ID> <domain>
      ```

- API {#api}

  Use the [Userpool.GetDomain](../../idp/api-ref/Userpool/getDomain.md) REST API method for the [Userpool](../../idp/api-ref/Userpool/index.md) resource or the [UserpoolService/GetDomain](../../idp/api-ref/grpc/Userpool/getDomain.md) gRPC API call.

{% endlist %}

## Deleting a domain {#delete}

You cannot delete the default domain or a domain with associated users.

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization) using an administrator or organization owner account.
  1. In the left-hand panel, click ![userpool](../../../_assets/organization/userpool.svg) **User pools** and select the [user pool](../../concepts/user-pools.md).
  1. Under **Domains**, click ![image](../../../_assets/console-icons/ellipsis.svg) next to the domain and select ![image](../../../_assets/console-icons/trash-bin.svg) **Delete**.
  1. In the window that opens, confirm deleting the domain.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for deleting a domain from a [user pool](../../concepts/user-pools.md):

     ```bash
     yc organization-manager idp userpool domain delete --help
     ```

  1. Run this command:

     ```bash
     yc organization-manager idp userpool domain delete <pool_ID> <domain>
     ```

- API {#api}

  Use the [Userpool.DeleteDomain](../../idp/api-ref/Userpool/deleteDomain.md) REST API method for the [Userpool](../../idp/api-ref/Userpool/index.md) resource or the [UserpoolService/DeleteDomain](../../idp/api-ref/grpc/Userpool/deleteDomain.md) gRPC API call.

{% endlist %}