Deny self-service registration requests from risky sources

Create a policy that denies self-service registration to users with disposable email domains or in risky network zones.

About this task

Early Access release. See Enable self-service features.

Self-service registration policies are mapped to user profile policies but are configured independently. If you don't make any changes, the policy's default rule allows self-service registration without IP or network zone restrictions. After a user initiates self-service registration, the user profile policy begins collecting the attributes required for profile enrollment.

This configuration denies self-service registration to users with a disposable email domain or an anonymizing proxy. Adapt these steps to your own use case.

Before you begin

  • Your org has Identity Threat Protection enabled.
  • You have an enhanced dynamic network zone configured for anonymizing proxies (ALL_ANONYMIZERS).
  • You have a user profile policy already configured for your org. See Collect profile information and register users.

Procedure

  1. In the Admin Console, go to Security > User Profile Policies.
  2. On the User Profile Policies page, find the policy that you want to update and click its Edit icon.
  3. Go to the Enrollment tab.
  4. In the Profile Enrollment section, click Edit.
  5. In the Self-service registration section, select Allowed. This selection enables the self-service registration policy so you can edit the Registration rules.
  6. In the Self-service registration section, click Save.
  7. In the Registration rules section, click Add rule.
  8. Name the rule.
  9. For User email domain is, select Disposable domain.
  10. For User's IP is, select In any of the following zones.
  11. Select the enhanced dynamic network zone that you configured for anonymizing proxies (ALL_ANONYMIZERS).
  12. For Registration, select Denied.
  13. Click Save.