Manage RAM user logon domains

Default domain name vs. domain alias

The following table compares these two options.

Example

Use case

Advantages

Prerequisites

Default domain name (Recommended)

@my-company.onaliyun.com

No custom domain needed.

Simple setup. No domain ownership required.
Memorable, company-specific alias.

An account alias.

Domain alias

(Advanced)

@my-company.com

Align logon domains with corporate email or brand identity.

Full customization. Integrates with existing email systems and strengthens brand recognition.

Domain ownership and DNS verification.

Method 1: Modify the default domain name

Each Alibaba Cloud account has a default domain name in the format <account alias>.onaliyun.com. Changing the account alias makes logon names more readable.

Initial state: The account alias defaults to your 16-digit account ID, so the initial default domain name is <account ID>.onaliyun.com. To find your account ID, see View your Alibaba Cloud account ID.
After modification: The default domain name becomes <new-alias>.onaliyun.com.

Note

The account alias must be unique within your Alibaba Cloud partition.
After you modify the account alias, the original default domain name (<account ID>.onaliyun.com) remains valid. RAM users can still log on with the old domain name.

Procedure

Console

Log on to the RAM console as a RAM administrator.
On the Settings page, in the Domain section, view the default domain name.
In the Actions column, click Edit to modify the default domain name.

Note
The domain name can contain up to 64 characters, including letters, digits, periods (.), hyphens (-), and underscores (_).

API

Call GetDefaultDomain to query the current default domain name.
Call SetDefaultDomain to modify the default domain name.

Next steps

RAM users can log on to the RAM console with the new default domain name. The logon name format is <UserName>@<new-alias>.onaliyun.com. Log on to the Alibaba Cloud console as a RAM user.
The default domain name simplifies SAML SSO configuration. Configure SAML settings for user SSO to an Alibaba Cloud SP.

Method 2: Create and verify a domain alias

If your organization owns a domain name such as example.com, you can set it as a domain alias. RAM users can then log on with usernames matching their corporate email addresses, such as <username>@example.com. Each Alibaba Cloud account supports only one domain alias.

Prerequisites

You own a publicly resolvable domain name.

Procedure

Step 1: Create a domain alias

Log on to the RAM console as a RAM administrator.
On the Settings page, in the Domain section, click Create alias domain.
In the Create alias domain dialog box, enter the domain name and click OK.

Note
The domain name can contain up to 64 characters, including letters, digits, periods (.), hyphens (-), and underscores (_).

Step 2: Verify domain ownership

Add a TXT record with your DNS provider to prove domain ownership.

Find the domain alias you created, click Verify Domain Ownership, and copy the TXT record value.
Log on to your domain's DNS management platform and add a TXT record for the domain.
1. If you use Alibaba Cloud DNS, paste the TXT record value into the Value field. TXT record.
2. If you use a different DNS provider, refer to their documentation.
Wait a few minutes for the DNS record to propagate.
Return to the RAM console to verify the domain.
1. On the Settings page, in the Domain section, find the target domain alias and click Actions in the Verify Domain Ownership column.
2. In the Verify Domain Ownership dialog box, confirm that the verification status is Passed and click OK.

Next steps

RAM users can log on to the RAM console with the configured domain alias. The logon name format is <UserName>@<domain-alias>. Log on to the Alibaba Cloud console as a RAM user.
A domain alias simplifies SAML SSO configuration. Configure SAML settings for user SSO to an Alibaba Cloud SP.