Enable Email Identity Protection

Email Identity Protection adds an authentication step before allowing users to access password resets and other types of account verification messages. This prevents attackers from using compromised mailboxes to hijack other services.

Configure this for both Google Workspace and M365 tenants if you have multiple.

Step One: Configure Server-Side Routing for Google Workspace:

Without being in the email delivery path, Material protects historical account verification messages and any new account verification messages when Email Identity Protection is enabled.

Google Workspace

Before you begin:

1. Ensure you have a Google Workspace Administrator account
2. In Google Workspace confirm comprehensive Mail Storage is disabled because it's incompatible with content compliance rules.
3. From Google Workspace, provision a new user account with a Gmail license.
4. Then, in Material, enable Mailbox Syncing and Account Connection for the account in step 2.

   1. From the workspace, click Explorer.
   2. Click Accounts.
   3. Find the new user account you just created in Google (it can take up to 30 minutes for the new account to sync), then click the row.
   4. Next to Status, click Edit (the pencil icon).
   5. Toggle Mailbox Syncing and Account Connection each to On:
   6. Click Save.

Complete configuration

1. Configure or verify the retention policy for this account in Google to avoid reaching the mailbox's storage limit and subsequent email delivery issues. Password resets and other types of account verification messages usually expire within a short timeframe so retention policies for this account could be as short as 30 days or less.
2. Select a tenant, then from the left navigation expand Email Identity Protection, then click Settings:

   

   Email Identity Protection > Settings
3. Follow the server-side routing instructions on the page to complete setup.

Microsoft 365

Before you begin:

1. Ensure you have a Microsoft 365 Administrator account with access to Exchange Online PowerShell.
2. In Microsoft 365, provision a new user account that can receive email and enter its email address below.
3. Then in Material, enable Mailbox Syncing and Account Connection for the account in step 2:

   1. From the workspace, click Explorer.
   2. Click Accounts.
   3. Find the new user account you just created in M365 (it can take up to 30 minutes for the new account to sync), then click the row.
   4. Next to Status, click Edit (the pencil icon).
   5. Toggle Mailbox Syncing and Account Connection each to On:
   6. Click Save.

Complete configuration

1. Configure or verify the retention policy for this account in Microsoft to avoid reaching the mailbox's storage limit and subsequent email delivery issues. Password resets and other types of account verification messages usually expire within a short timeframe so retention policies for this account could be as short as 30 days or less.
2. Select a tenant, then from the left navigation expand Email Identity Protection, then click Settings:

   

   Email Identity Protection > Settings
3. Follow the server-side routing instructions on the page to complete setup.

---

Step Two: Optionally, Run a Trial Period

You can enable Email Identity Protection for a few accounts or a group first to run a test period. This is a good opportunity to get feedback from users, soft launch the redaction process, and test your communication for a larger, org-wide launch.

1. From the workspace, click Explorer.
2. Click Accounts or Groups.
3. Check the box next an account(s) or group.
4. Click Edit Settings.
5. Select Override Password Reset & App Signup Protection, then toggle it On.

Email Identity Protection enabled for a single account or group

---

Step Three: Communicate with your users

Before completing Email Identity Protection configuration, let them know what to expect from the account verification process. See Communication Templates for examples.