# Ensure all workspace members use approved company email domains

- Source: https://support.icompaas.com/support/solutions/articles/a_1793876661052838-ensure-all-workspace-members-use-approved-company-email-domains
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Render Cloud](https://support.icompaas.com/support/solutions/c_1793875953948152) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1793875960840493)
- Last updated: 2026-11-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure every member of the Render workspace signs in with an email address on a domain the organization has approved, such as the company domain, and not with personal email accounts like Gmail or Outlook, or accounts from unrelated external organizations.

**Rationale**

Personal accounts are outside the company's control: they cannot be disabled when someone leaves, and they may not follow company security rules. Members using approved company domains are easier to manage, audit, and offboard, and access can be tied to the company's identity system.

**Impact**

-   Every member is tied to a company-controlled identity
    
-   Easier offboarding and access reviews
    
-   Members using personal emails must be re-invited with company accounts
    

**Default Value**

By default, Render allows any email address to be invited to a workspace.

**Pre-Requisites**

-   Workspace Admin role
    
-   A list of approved email domains
    

**Remediation**

**Test Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.
    
3.  Scroll down to the Team members section and review the email address of each member.
    
4.  If any member uses an email domain that is not approved, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.
    
3.  In the Team members section, click + Invite members, enter the person's approved company email address, and select the same role from the dropdown.
    
4.  After they accept, open the ••• menu next to the old account and click Remove team member.
    
5.  To prevent this in future, enforce Google account login (see the login restriction check) or use SAML SSO on Scale or Enterprise plans.
    

**Backout Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.
    
3.  Invite the previous account again with + Invite members if it was removed by mistake.
    

**Reference**

-   [https://render.com/docs/team-members](https://render.com/docs/team-members)
    
-   [https://render.com/docs/login-settings](https://render.com/docs/login-settings)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.