> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/getting-started/deployment-guides/deploy-account-takeover-resilience-ator/enable-identity-protection.md).

# Enable Password Reset & App Signup Protection

Password Reset & App Signup Protection adds an authentication step before allowing users to access password resets and other types of account verification messages. This prevents attackers from using compromised mailboxes to hijack other services.

Configure this for both Google Workspace and M365 tenants if you have multiple.

## **Step One: Configure Server-Side Routing for Google Workspace:**

Without being in the email delivery path, Material protects historical account verification messages and any new account verification messages when Identity Protection is enabled.

<details>

<summary>Google Workspace</summary>

#### Before you begin:

1. Ensure you have a [Google Workspace Administrator account](https://support.google.com/a/answer/2405986?hl=en)
2. In Google Workspace confirm [comprehensive Mail Storage](https://support.google.com/a/answer/3547347?hl=en) is disabled because it's incompatible with content compliance rules.
3. From Google Workspace, provision a new user account with a Gmail license.
4. Then, in Material, enable **Mailbox Syncing** and **Account Connection** for the account in step 2.
   1. From the workspace, click **Explorer**.
   2. Click **Accounts.**
   3. Find the new user account you just created in Google (it can take up to 30 minutes for the new account to sync), then **click the row**.
   4. Next to **Status**, click **Edit** (the pencil icon).
   5. Toggle **Mailbox Syncing** and **Account Connection** each to **On**: ![](/files/3l1Z7MBdofIbGvA7MqIo)
   6. Click **Save**.

#### Complete configuration

1. Configure or verify the retention policy for this account in Google to avoid reaching the mailbox's storage limit and subsequent email delivery issues. Password resets and other types of account verification messages usually expire within a short timeframe so retention policies for this account could be as short as 30 days or less.
2. From Settings <img src="/files/eXnlZvBdwEsOlOOhCXrD" alt="" data-size="line">, click **Identity Protection**.
3. Under Server-Side Routing, click **Configure:**

   <figure><img src="/files/y5Qc1sJ1wui8Cd1rJ0ys" alt="image of server side routing configuration location in settings" width="284"><figcaption><p>Settings > Identity Protection</p></figcaption></figure>
4. Follow the instructions on the Server-Side Routing screen to complete.

</details>

<details>

<summary>Microsoft 365</summary>

#### Before you begin:

1. Ensure you have a Microsoft 365 Administrator account with access to [Exchange Online PowerShell](https://learn.microsoft.com/en-us/powershell/exchange/connect-to-exchange-online-powershell?view=exchange-ps).
2. In Microsoft 365, provision a new user account that can receive email and enter its email address below.
3. Then in Material, enable **Mailbox Syncing** and **Account Connection** for the account in step 2:
   1. From the workspace, click **Explorer**.
   2. Click **Accounts.**
   3. Find the new user account you just created in M365 (it can take up to 30 minutes for the new account to sync), then **click the row**.
   4. Next to **Status**, click **Edit** (the pencil icon).
   5. Toggle **Mailbox Syncing** and **Account Connection** each to **On**: ![](/files/3l1Z7MBdofIbGvA7MqIo)
   6. Click **Save**.

#### Complete configuration

1. Configure or verify the retention policy for this account in Microsoft to avoid reaching the mailbox's storage limit and subsequent email delivery issues. Password resets and other types of account verification messages usually expire within a short timeframe so retention policies for this account could be as short as 30 days or less.
2. From Settings <img src="/files/eXnlZvBdwEsOlOOhCXrD" alt="" data-size="line">, click **Identity Protection**.
3. Under Server-Side Routing, click **Configure:**

   <figure><img src="/files/y5Qc1sJ1wui8Cd1rJ0ys" alt="image of server side routing configuration location in settings" width="284"><figcaption><p>Settings > Identity Protection</p></figcaption></figure>
4. Follow the instructions on the Server-Side Routing screen to complete.

</details>

***

## **Step Two: Optionally, Run a Trial Period**

You can enable Password Reset & App Signup Protection for a few accounts or a group first to run a test period. This is a good opportunity to get feedback from users, soft launch the redaction process, and test your communication for a larger, org-wide launch.

1. From the workspace, click **Explorer**.
2. Click **Accounts** or **Groups**.
3. Check the box next an account(s) or group.
4. Click **Edit Settings**.
5. Toggle **Set custom Password Reset & App Signup Protection** to **On**.

<figure><img src="/files/KnnwpzmGp1fK92rnmVEU" alt="Identity Protection enabled for a single account or group"><figcaption><p>Identity Protection enabled for a single account or group</p></figcaption></figure>

***

## Step Three: Communicate with your users

Before completing Identity Protection configuration, let them know what to expect from the account verification process. See [Communication Templates](/getting-started/deployment-guides/communication-templates.md) for examples.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.material.security/getting-started/deployment-guides/deploy-account-takeover-resilience-ator/enable-identity-protection.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.