XMPP server software doesn't generally default to allowing account registration when first installed, but many people enable it as an easy way to on-board users

XMPP server software doesn't generally default to allowing account registration when first installed, but many people enable it as an easy way to on-board users. Either they don't realize the consequences of doing this on an internet-accessible service, and/or they have the intention of closing it later. Needless to say there are better alternatives, such as LDAP integration, which should be used to link accounts with an organization's existing identity management. For smaller or more casual deployments, in Prosody we've made a big push towards invitation-based registration. This requires no external dependencies (e.g. LDAP or a database) and allows the server admin to control account creation on the server. As a bonus, it's also way easier for users: https://blog.prosody.im/great-invitations/ https://blog.prosody.im/great-invitations/ XMPP also supports anonymous authentication, again not enabled by default, but anonymous sessions also generally have tighter restrictions (such as no access to federation, and IP-based limits). This authentication method is usually used for public web chats and XMPP-based APIs that offer read-only access.