• Disable new sign ups
• Require administrator approval for new sign ups
• Require email confirmation
• User cap
  • Set the user cap number
• Remove the user cap
• Soft email confirmation
• Minimum password length limit
• Allow or deny sign ups using specific email domains
  • Allowlist email domains
  • Denylist email domains
  • Create email domain allowlist or denylist
  • Enable or disable soft email confirmation

Sign-up restrictions

You can enforce the following restrictions on sign ups:

• Disable new sign ups.
• Require administrator approval for new sign ups.
• Require user email confirmation.
• Allow or deny sign ups using specific email domains.

Disable new sign ups

By default, any user visiting your GitLab domain can sign up for an account. For customers running public-facing GitLab instances, we highly recommend that you consider disabling new sign ups if you do not expect public users to sign up for an account.

To disable sign ups:

1. On the top bar, select Menu > Admin.
2. In the left sidebar, select Settings > General, and expand Sign-up restrictions.
3. Clear the Sign-up enabled checkbox, then select Save changes.

Require administrator approval for new sign ups

When this setting is enabled, any user visiting your GitLab domain and signing up for a new account must be explicitly approved by an administrator before they can start using their account. In GitLab 13.6 and later, this setting is enabled by default for new GitLab instances. It is only applicable if sign ups are enabled.

To require administrator approval for new sign ups:

1. On the top bar, select Menu > Admin.
2. In the left sidebar, select Settings > General, and expand Sign-up restrictions.
3. Select the Require admin approval for new sign-ups checkbox, then select Save changes.

In GitLab 13.7 and later, if an administrator disables this setting, the users in pending approval state are automatically approved in a background job.

Require email confirmation

You can send confirmation emails during sign up and require that users confirm their email address before they are allowed to sign in.

To enforce confirmation of the email address used for new sign ups:

1. On the top bar, select Menu > Admin.
2. In the left sidebar, select Settings > General, and expand Sign-up restrictions.
3. Select the Enable email restrictions for sign ups checkbox, then select Save changes.

User cap

When the number of billable users reaches the user cap, any user who is added or requests access must be approved by an administrator before they can start using their account.

If an administrator increases or removes the user cap, the users in pending approval state are automatically approved in a background job.

Set the user cap number

1. On the top bar, select Menu > Admin.
2. In the left sidebar, select Settings > General.
3. Expand Sign-up restrictions.
4. Enter a number in User cap.
5. Select Save changes.

New user sign ups are subject to the user cap restriction.

Remove the user cap

1. On the top bar, select Menu > Admin.
2. In the left sidebar, select Settings > General.
3. Expand Sign-up restrictions.
4. Remove the number from User cap.
5. Select Save changes.

New users sign ups are not subject to the user cap restriction. Users in pending approval state are automatically approved in a background job.

Soft email confirmation

The soft email confirmation improves the sign-up experience for new users by allowing them to sign in without an immediate confirmation when an email confirmation is required. GitLab shows the user a reminder to confirm their email address, and the user can’t create or update pipelines until their email address is confirmed.

Minimum password length limit

You can change the minimum number of characters a user must have in their password using the GitLab UI.

Allow or deny sign ups using specific email domains

You can specify an inclusive or exclusive list of email domains which can be used for user sign up.

These restrictions are only applied during sign up from an external user. An administrator can add a user through the admin panel with a disallowed domain. Also, note that the users can change their email addresses to disallowed domains after sign up.

Allowlist email domains

You can restrict users only to sign up using email addresses matching the given domains list.

Denylist email domains

You can block users from signing up when using an email addresses of specific domains. This can reduce the risk of malicious users creating spam accounts with disposable email addresses.

Create email domain allowlist or denylist

To create an email domain allowlist or denylist:

1. On the top bar, select Menu > Admin.
2. In the left sidebar, select Settings > General, and expand Sign-up restrictions.

3. For the allowlist, you must enter the list manually. For the denylist, you can enter the list manually or upload a .txt file that contains list entries.

   Both the allowlist and denylist accept wildcards. For example, you can use *.company.com to accept every company.com subdomain, or *.io to block all domains ending in .io. Domains must be separated by a whitespace, semicolon, comma, or a new line.

   

Enable or disable soft email confirmation

Soft email confirmation is under development but ready for production use. It is deployed behind a feature flag that is disabled by default. GitLab administrators with access to the GitLab Rails console can opt to disable it.

To enable it:

Feature.enable(:soft_email_confirmation)

To disable it:

Feature.disable(:soft_email_confirmation)