When a user signs into a custom domain and reports suspicious activity by navigating to Recent Activity > Report, the Suspicious Activity Report email is received from noreply@okta.com instead of the custom email that was configured. 
 

This knowledge article aims to clarify how to change the email address for the Default brand to be the same as the email address for any custom brand.

• Suspicious Activity Reporting
• Customize domain and email address

The Suspicious Activity Report is sent using the Default brand, which is configured to send emails using noreply@okta.com.

• The solution is to associate the custom email domain with the default Okta domain using API.
  For more information, review the following knowledge article: Associate Custom Email Domain with the Default Okta Domain.

Related References

• Associate Custom Email Domain with The Default Okta Domain
• Customize domain and email address
• Brands API
• Creating Multiple Custom Domains on a Single Okta Org