Hi all,
When new users register in the platform, they are allowed to take courses even before they confirm their email. Is is possible to completely block users into the LMS until they confirm their email, even the first time?
According to the enrollment requirements Enrollment Requirements — Latest documentation
Before a learner can enroll in a course, he or she must complete these steps.
- Register a user account, which includes supplying a valid email address, or your implementation of the Open edX platform. Each platform requires a separate user account.
- Activate the registered account by following the emailed instructions.
As long as the course enrollment end date has not passed, learners who have registered and activated user accounts can enroll themselves in courses on your Open edX instance, or can enroll in other courses on your instance if they know the URL.
But this seems contradictory to your experience, not sure if the docs are outdated or your setup is different. Sorry I don’t have any actually useful info 
I have tested in the sandbox and the first time you access after registering you can do anything in the platform, even take exams, without activating the account.
I have created an issue in GH: Non active users can enroll in courses · Issue #36402 · openedx/edx-platform · GitHub.