# Require email activation before Admin approval
**URL:** https://meta.discourse.org/t/require-email-activation-before-admin-approval/41843
**Category:** Feature
**Created:** [March 31, 2016, 8:46pm UTC](https://meta.discourse.org/t/require-email-activation-before-admin-approval/41843 "2016-03-31T20:46:43Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@precessor](https://meta.discourse.org/u/precessor)
#### Post date: [March 31, 2016, 8:46pm UTC](https://meta.discourse.org/t/require-email-activation-before-admin-approval/41843/1 "2016-03-31T20:46:43Z")
I have a discussion site where Admin approval of new users is a necessity. However, I would like to ensure email activation has occurred before the approval is requested. And, when the new user has activated their email address, to receive some sort of notification that a new user is ready for approval. I am not sure I can accomplish this.
The use case is
- New user registers, automatically receives activation email, clicks the activation link. However, user does still not have access to content - Admin approval still needed
- Admin receives notification, approves (or not)
- User receives email “hey, you’re in!”
Is this possible?
Thanks
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [April 1, 2016, 12:46am UTC](https://meta.discourse.org/t/require-email-activation-before-admin-approval/41843/2 "2016-04-01T00:46:52Z")
Yeah there are site settings for it
`login required` and `must approve users`
---
### Author:  [@precessor](https://meta.discourse.org/u/precessor)
#### Post date: [April 1, 2016, 7:38am UTC](https://meta.discourse.org/t/require-email-activation-before-admin-approval/41843/3 "2016-04-01T07:38:22Z")
I don’t think that _automatically_ ensures the email address is verified before Admin approval is requested.
As admin I must (i) manually force email verification for each user, or (ii) check and approve the user.
In my case (ii) is a bit of work (checking a non-disclosure agreement is in place for that user) and I would like to avoid it if the email isn’t genuine.
Practically, (ii) is a bit slicker from the new-user perspective, because s/he doesn’t have two wait periods (one before email activation is forced, then before approval is granted).
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [January 2, 2019, 9:22am UTC](https://meta.discourse.org/t/require-email-activation-before-admin-approval/41843/4 "2019-01-02T09:22:27Z")
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [January 2, 2019, 9:42am UTC](https://meta.discourse.org/t/require-email-activation-before-admin-approval/41843/5 "2019-01-02T09:42:59Z")
This is a feature discussion.
I remember discussing this early on – what’s more important?
a) determining if the user’s email is valid?
b) deciding if the user is allowed to join?
If a user goes to the trouble of validating their email, _then is rejected by staff_.. that’s a pretty bad experience. Until you’ve decided whether they are allowed, email validity does not matter.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [January 2, 2019, 9:46am UTC](https://meta.discourse.org/t/require-email-activation-before-admin-approval/41843/6 "2019-01-02T09:46:07Z")
I think this already got changed:
> [@Change email after registering and pending activation?](https://meta.discourse.org/t/change-email-after-registering-and-pending-activation/68243/16):
>
> The issue here is someone doesn’t ever want users to change their emails, and they were allowed to do so following approval if they hadn’t activated their original email. It doesn’t seem like a security hole to me since the user still had the authenticate the email, but I understand in some rare situations forum owners don’t want users to change their emails. The solution is what’s suggested earlier: don’t allow staff to approve a user until they’ve confirmed their email address. [https://githu…](https://github.com/discourse/discourse/commit/db929e58fc02923ddc2d09add5103aaba73c027f)
> [@codinghorror](#):
>
> Until you’ve decided whether they are allowed, email validity does not matter.
The issue here is when people use the email to identify someone. If I see someone sign up as `jeff@discourse.org` on my forum, I could click “approve”, and then they could swap out the email address with something else.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [January 2, 2019, 9:47am UTC](https://meta.discourse.org/t/require-email-activation-before-admin-approval/41843/7 "2019-01-02T09:47:16Z")
Aha! Excellent, so we can close this as complete then.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [January 2, 2019, 9:47am UTC](https://meta.discourse.org/t/require-email-activation-before-admin-approval/41843/8 "2019-01-02T09:47:18Z")