Allow/Block Email Logins

Detects accounts using email domains that are on your block list, not on your allow list, or that appear across fewer than 5 (configurable) accounts in the last 30 days. You can toggle between using a block list or an allow list, and enable auto-discovery of rare domains to flag uncommon email providers without manual list maintenance. An ignore list is available to suppress alerts for known-good domains.

Recommended Actions

Depending on your security posture, consider deleting users using emails with those domains and exploring why you have them in the system.

Default Check Settings

Auto-Discovery of Rare Domains: enabled

Rare Domain Occurrence Threshold (Past 30 Days): 5

Compatibility