Self-service registration

The self-service registration policy is an optional layer of protection for public sign-up flows. It lets you block registration attempts coming from risky sources before a new account is created.

Early Access release. See Enable self-service features.

How it works

The self-service registration policy works with your user profile policy. When a user clicks Sign Up in your Sign-In Widget, the self-service registration policy runs first and can reject suspicious attempts based on rules for IPs, ASNs, countries, proxies, or disposable email domains. If it doesn't block the request, the user profile policy takes over, handling things like email verification, profile attributes, and the registration interface.

Each user profile policy in your org is paired with its own linked self-service registration policy, and that pairing allows everything by default. This means that your existing behavior doesn't change unless you add your own rules to the self-service registration policy.

What you can evaluate

You can add 10 rules per self-service registration policy. Each rule can allow or deny registration based on these two criteria:

Disposable email domains: These domains can be used briefly and then discarded, letting someone register without a real, ongoing email identity. Because they're free, instant to create, and leave no lasting trail back to the person, they're a common tool for attackers running fraudulent self-service registrations at scale. A single bad actor can spin up many accounts by pairing throwaway addresses with automation, without any of the friction or persistence a real inbox would impose. Denying registration to these domains removes a large share of fraudulent registrations.
User's IP address: Risky IP addresses are network locations that are associated with abuse: specific IPs, ASNs, countries, or anonymizing proxies. Attackers routing through flagged infrastructure or proxy networks can mask their origin and register at scale from the same suspicious sources repeatedly. Network zone conditions in self-service registration policies use the same logic that allows or denies authentication in your global session and app sign-in policies.

Availability

This feature is offered through Identity Threat Protection (ITP). If your org doesn't have an ITP license, your user profile policies let you hide or display the Sign Up link, but you can't add registration rules.

If your org has an ITP license and you disable this feature, self-service registration policies are removed from user profile policies. Their original configuration is restored.