> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/getting-started/deployment-guides/deploy-account-takeover-resilience-ator/enable-identity-protection.md).
# Enable Email Identity Protection
Email Identity Protection adds an authentication step before allowing users to access password resets and other types of account verification messages. This prevents attackers from using compromised mailboxes to hijack other services.
Configure this for both Google Workspace and M365 tenants if you have multiple.
## **Step One: Configure Server-Side Routing.**
Email Identity Protection works without being in the email delivery path. It protects existing account verification messages and any new ones once it's turned on. For the most secure setup, also set up server-side routing. Routing rules send messages like password resets and verification codes to a secure mailbox, where they wait until the user verifies their identity.
{% hint style="success" %}
**Before you begin**
Both providers also need a dedicated mailbox account that Material is syncing. Create one following these guidelines:
* **Google Workspace:** you need a [Google Workspace administrator account](https://support.google.com/a/answer/2405986?hl=en), and **Comprehensive Mail Storage** must be turned off.
* **Microsoft 365:** you need a Microsoft 365 administrator account with access to [Exchange Online PowerShell.](https://learn.microsoft.com/en-us/powershell/exchange/connect-to-exchange-online-powershell?view=exchange-ps) New routing rules can take up to a day to take effect.
Both providers also need a dedicated mailbox account that Material is syncing.
{% endhint %}
Material gives you setup instructions tailored to your tenant, including the rules or script to copy. Set up routing for each Google Workspace and Microsoft 365 tenant you have.
**To view the setup instructions:**
1. From the top toolbar, choose your tenant from the drop-down. The instructions only appear once a tenant is selected.
2. From the left navigation, expand **Email Identity Protection**, then click **Settings**.
3. Follow the steps on the page for your email provider.
***
## **Step Two: Optionally, Run a Trial Period**
You can enable Email Identity Protection for a few accounts or a group first to run a test period. This is a good opportunity to get feedback from users, soft launch the redaction process, and test your communication for a larger, org-wide launch.
1. From the workspace, click **Explorer**.
2. Click **Accounts** or **Groups**.
3. Check the box next an account(s) or group.
4. From the bottom toolbar, click **Edit Group Settings**.
5. Under Email Identity Protection, select **Override Email Identity Protection**, then toggle it **On**.
Email Identity Protection enabled for a single account or group
***
## Step Three: Communicate with your users
Before completing Email Identity Protection configuration, let them know what to expect from the account verification process. See [Communication Templates](/getting-started/deployment-guides/communication-templates.md) for examples.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.material.security/getting-started/deployment-guides/deploy-account-takeover-resilience-ator/enable-identity-protection.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
