Pending approval and account invitations

Updated October 16, 2026

Signed in to NetBird and landed on a Waiting for Approval screen, or in a NetBird account you don't recognize? This usually is not a bug. It almost always means you were added to an existing organization automatically, and someone in that organization still has to approve you.

The opposite also happens: a teammate signs in and gets a new, empty account of their own instead of joining yours. See A teammate got their own account.

If the screen asks you to wait for approval from your own email address, see The screen names your own address.

What the Waiting for Approval screen tells you

After you sign in, the dashboard shows three steps: Account Created, Waiting for Approval, and Join Account. Your user exists, but the account requires new users to be approved before they can use it, so you are held at the second step until someone approves you.

Below the steps, the screen names the owner of the account you are waiting to join, for example li****g@example.com. Most of the part before the @ is hidden to protect the owner's privacy, but the domain is shown in full. That domain is the quickest way to tell which organization you are waiting on.

If the screen only says "Ask the owner of the account to approve your access", with no address, NetBird could not look up the owner's email. Everything below still applies.

The screen has two buttons:

• Refresh checks again whether you have been approved. Use it once someone tells you they approved you.
• Log Out signs you out. Use it if you signed in with the wrong account, or you don't want to join this one.

Why this happens

NetBird can add people to an account without a manual, one-by-one invite:

• Domain matching. On NetBird Cloud, new sign-ups join an existing account automatically when their email domain belongs to it: either the private domain the account signed up with, or another domain the account has verified as a sign-in domain. See Indirect user invites.
• Identity provider sync. If your organization connects NetBird to its identity provider, being added to a synced group in the IdP provisions your user in NetBird. See Provision users and groups from your identity provider.
• Approval is required. When an account turns on user approval, new users stay blocked until an admin approves them. That block is the Waiting for Approval screen you see.

What to do

1. Check the domain on the screen. It is normally your organization's email domain. Confirm with your IT or security team that they run NetBird and expect you on it. If the address looks like your own, see The screen names your own address instead.
2. Ask the owner or an admin to approve you. The screen names the account Owner, of which there is exactly one per account, but any admin can approve you as well. They do it from the dashboard's user list. See Approve or reject user.
3. Click Refresh once you are approved. The screen moves you into the account. If it still shows Waiting for Approval, your browser may be holding on to a cached session: open the dashboard in a private browser window and sign in again.
4. If something looks off, for example the domain is not your organization's, you don't recognize the account, or no one internally owns it, do not ask anyone to approve you. Click Log Out, treat it as suspicious, and verify internally first.

The screen names your own address

You signed in as lisa.wong@example.com, and the Waiting for Approval screen says you are waiting on li****g@example.com. The Owner you are waiting on is you.

On NetBird Cloud, this happens when you created the account with one sign-in method, for example Google or Microsoft, and later signed in with a different one, for example an email address and password. NetBird tells users apart by how they sign in, not by their email address, so the second sign-in created a second user with the same email. Its domain, example.com, already belongs to the account you own, so domain matching added that second user to your account, where it waits for approval from the Owner: you, under your original sign-in method.

The two users are not linked, and approving the second one does not merge them. It only gives you a second user in your account with the User role, not Owner. To get back in as Owner:

1. Click Log Out.
2. Sign in with the method you used to create the account. If you don't remember which one, try each option on the sign-in page with the same email address. The right one opens your account as its Owner, with your peers and settings.
3. Reject the extra user. In Team → Users, the second user shows your email address and is waiting for approval. Click Reject to remove it. See Approve or reject user.

From then on, sign in with your original method only. If you use the other method again, NetBird creates the second user again and you are back on this screen.

If your account does not require user approval, you don't see this screen. The second sign-in joins your account straight away with the User role, so you are in your own account but can't manage it. Log out and sign in with your original method as in steps 1 and 2. The extra user is not pending, so you can't reject it: in Team → Users, open the actions menu on its row and click Delete instead.

If you signed up with a public email address, such as a Gmail account, domain matching never applies. The second sign-in lands in a new, empty account of its own instead. Sign out and sign in with your original method to get back to your account. If you don't need the empty account, sign in to it once more and delete it.

A teammate got their own account

A teammate signs in to NetBird Cloud and lands in a new, empty account, with none of your peers, users, or policies. NetBird did not match their email domain to your account, so it created a separate one for them. One of these is usually the reason:

• They use another of your business's domains. Only the domain your account signed up with matches from the start. A country domain such as company.co.uk, a subsidiary, or a second brand matches only after an Owner or Admin adds and verifies it as a sign-in domain.
• They signed in with a personal address, such as a Gmail account. Public email domains never match an account. Ask them to sign in with their work address instead. You can't invite them directly now that they have their own account, so if they need to keep the personal address, contact NetBird Support.
• Your domain was not classified as private. NetBird only groups sign-ups by domain when it classifies the domain as private. If it is unsure, it plays safe and does not group them. NetBird Support can correct the classification. See Indirect user invites.

To fix it for the next person, an Owner or Admin adds and verifies the domain under Settings → Authentication → Sign-in Domains, or invites the user directly. Do this before onboarding a team on another domain, not after.

The Sign-in Domains section only appears once your account's own domain is classified as private. If you don't see it, invite the user directly or contact NetBird Support.

To confirm the cause, ask your teammate which email address they signed in with, and check its domain against the Sign-in Domains list.

Verifying a domain does not move a teammate who already has an account of their own: it only changes where new sign-ins land, and inviting or syncing them fails until they leave that account. For a teammate already in a separate account, see User already belongs to another NetBird account.

If your account requires user approval, a teammate who joins through domain matching is held for approval. That is the Waiting for Approval screen above, and an admin approves them as described in What to do.