diff --git a/manifests/init.pp b/manifests/init.pp
index f7f6957a1..62fd7cb52 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -148,8 +148,14 @@
 #   Default to $::os_service_default
 #
 # [*notification_format*]
-#   Format for the notifications. Valid values are 'basic' and 'cadf'.
-#   Default to undef
+#   (Optional) Define the notification format for identity service events.
+#   Valid values are 'basic' and 'cadf'.
+#   Default to $::os_service_default
+#
+# [*notification_opt_out*]
+#   (Optional) Opt out notifications that match the patterns expressed in this
+#   list.
+#   Defaults to $::os_service_default
 #
 # [*control_exchange*]
 #   (Optional) AMQP exchange to connect to if using RabbitMQ
@@ -413,6 +419,7 @@ class keystone(
   $notification_driver                  = $::os_service_default,
   $notification_topics                  = $::os_service_default,
   $notification_format                  = $::os_service_default,
+  $notification_opt_out                 = $::os_service_default,
   $control_exchange                     = $::os_service_default,
   $rpc_response_timeout                 = $::os_service_default,
   $service_name                         = $::keystone::params::service_name,
@@ -590,7 +597,11 @@ class keystone(
   keystone_config {
     'token/provider':              value => $token_provider;
     'DEFAULT/max_token_size':      value => $max_token_size;
-    'DEFAULT/notification_format': value => $notification_format;
+  }
+
+  keystone_config {
+    'DEFAULT/notification_format':  value => $notification_format;
+    'DEFAULT/notification_opt_out': value => $notification_opt_out;
   }
 
   oslo::messaging::default { 'keystone_config':
diff --git a/releasenotes/notes/notification_opt_out-5c87151211fe8840.yaml b/releasenotes/notes/notification_opt_out-5c87151211fe8840.yaml
new file mode 100644
index 000000000..3580b07ee
--- /dev/null
+++ b/releasenotes/notes/notification_opt_out-5c87151211fe8840.yaml
@@ -0,0 +1,4 @@
+---
+features:
+  - |
+    The new ``keystone::notification_opt_out`` parameter has been added.
diff --git a/spec/classes/keystone_init_spec.rb b/spec/classes/keystone_init_spec.rb
index 7572d6b6d..445b5d7dd 100644
--- a/spec/classes/keystone_init_spec.rb
+++ b/spec/classes/keystone_init_spec.rb
@@ -56,6 +56,7 @@ describe 'keystone' do
         is_expected.to contain_keystone_config('token/provider').with_value('fernet')
         is_expected.to contain_keystone_config('DEFAULT/max_token_size').with_value('<SERVICE DEFAULT>')
         is_expected.to contain_keystone_config('DEFAULT/notification_format').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_keystone_config('DEFAULT/notification_opt_out').with_value('<SERVICE DEFAULT>')
 
         is_expected.to contain_oslo__messaging__default('keystone_config').with(
           :transport_url        => '<SERVICE DEFAULT>',
@@ -134,6 +135,11 @@ describe 'keystone' do
           :token_provider               => 'uuid',
           :max_token_size               => 255,
           :notification_format          => 'basic',
+          :notification_opt_out         => [
+            'identity.authenticate.success',
+            'identity.authenticate.pending',
+            'identity.authenticate.failed'
+            ],
         }
       end
 
@@ -157,6 +163,11 @@ describe 'keystone' do
         is_expected.to contain_keystone_config('token/provider').with_value('uuid')
         is_expected.to contain_keystone_config('DEFAULT/max_token_size').with_value(255)
         is_expected.to contain_keystone_config('DEFAULT/notification_format').with_value('basic')
+        is_expected.to contain_keystone_config('DEFAULT/notification_opt_out').with_value([
+          'identity.authenticate.success',
+          'identity.authenticate.pending',
+          'identity.authenticate.failed'
+        ])
       end
     end