Emails you when there's an outstanding invitation for someone to join an account - before it's even accepted. Catching it at the invite stage is the earliest possible point to stop unwanted access: the invite can be cancelled and nobody ever gets in.
Defaults & settings
External domains only - only alert on invites to addresses outside your team domain (default on, with your agency domain treated as internal), versus any pending invite at all.
Checks every 5 minutes; 24-hour cooldown.
Example. Someone with existing access invites
[email protected]. The invite sits pending - and you already have the email. Cancel it in Google Ads and the door never opened.
Good to know. Together, the three access rules cover the whole way in: invites (before entry), new users (at entry), and manager links (bulk entry). The damage-side rules - setting changes, runaway spend, tracking tampering - cover what happens after. See Entry watches vs Damage watches.