Authorized Email Domains

Authorized Email Domains is a Setup page where administrators specify which email domains are approved for use in the org. When configured, only users with email addresses from authorized domains can log in, helping organizations enforce security policies and prevent unauthorized access from personal email accounts.

When user provisioning isn't tightly controlled, personal Gmail and Yahoo addresses slip into the user list - a contractor never moved over to corp email, a personal address used during a Trailhead trial, a service account someone set up "just for testing." Authorized Email Domains is the gate that prevents this. Add only your corporate domains here, and Salesforce refuses to create or update users with email addresses outside that list.

The reason this matters past basic hygiene is that the User object is the trust anchor for almost everything else - login policies, MFA enforcement, sharing rules, and most audit trails are all keyed off it. Letting personal-domain users accumulate is how orgs end up with active logins six months after someone leaves the company. Configure this early, audit it during every offboarding cycle, and treat any exception as a deliberate, time-bound decision.