Description

Ensure every member of the Render workspace signs in with an email address on a domain the organization has approved, such as the company domain, and not with personal email accounts like Gmail or Outlook, or accounts from unrelated external organizations.

Rationale

Personal accounts are outside the company's control: they cannot be disabled when someone leaves, and they may not follow company security rules. Members using approved company domains are easier to manage, audit, and offboard, and access can be tied to the company's identity system.

Impact

  • Every member is tied to a company-controlled identity

  • Easier offboarding and access reviews

  • Members using personal emails must be re-invited with company accounts

Default Value

By default, Render allows any email address to be invited to a workspace.

Pre-Requisites

  • Workspace Admin role

  • A list of approved email domains

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.

  3. Scroll down to the Team members section and review the email address of each member.

  4. If any member uses an email domain that is not approved, follow the implementation steps.

Implementation Steps

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.

  3. In the Team members section, click + Invite members, enter the person's approved company email address, and select the same role from the dropdown.

  4. After they accept, open the ••• menu next to the old account and click Remove team member.

  5. To prevent this in future, enforce Google account login (see the login restriction check) or use SAML SSO on Scale or Enterprise plans.

Backout Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.

  3. Invite the previous account again with + Invite members if it was removed by mistake.

Reference