Overview

Since January 2022, org admins can now enable the Prevent unregistered user spend option under usage control.
By doing so, only registered users will be allowed to trigger pipelines. While this setting was originally introduced to help prevent unregistered users from triggering builds, it is primarily a security feature, not just a cost-control measure. Enabling it helps ensure that only expected and properly authenticated users or systems can run pipelines in your organization.

How to enable the Prevent unregistered user spend option

1. Confirm Admin Permissions
To enable usage controls, you must have admin permissions for your organization. If you're unsure, please refer to this article: Am I an organization admin?

2. Navigate to the Plan Settings Page

Go to your organization’s plan settings by clicking the Plan tab on the left-hand side of the CircleCI app. Alternatively, you can go directly to this URL:

https://app.circleci.com/settings/plan/github/ORGNAME/overview

3. Enable Usage Control
Under the Usage Controls tab, locate the switch labeled Prevent unregistered user spend. Toggle the switch on to enable it (it will turn blue when active). To disable it later, simply toggle it back off.

How to Confirm the Feature is Working

Once enabled, the feature takes effect immediately. Any user who is not registered with your organization will be unable to trigger a build.

For unregistered users, pipelines will fail to start, and the block-unregistered-user error message will be displayed as shown below:

⚠️ Important: Bots and Automated Systems May Be Blocked

When you enable the Prevent unregistered user spend option, any bot, automation tool, or external service that does not have a registered CircleCI account linked to your VCS will be blocked from triggering builds.

This includes:

• CI/CD bots that run workflows automatically

• Dependency management bots (e.g., Renovate, Dependabot, etc.)

• Service accounts or scripts that trigger pipelines without being registered CircleCI users

Additional Resources:

• What is an "Unregistered User"?
• Unregistered User - Usage Controls