Appearance

Require SSO and the owner fallback ​

Available onEnterprise
Who can do thisWorkspace owners

Require SSO blocks password sign-in for everyone whose email is on one of your verified domains. Turn it on only after SSO sign-in works.

Turn on Require SSO ​

  1. Sign in with SSO at least once yourself. Until someone has, the switch is greyed out with Sign in with SSO once before you require it.
  2. In the sidebar, click Settings, then Single sign-on.
  3. Under 3 Turn it on, switch on Require SSO.
  4. Click Save.

The Status panel now says On and required.

What changes for your team ​

  • People on your verified domains who try a password see Your workspace requires single sign-on. Use "Sign in with SSO" instead.
  • Their open password sessions end. Anyone already signed in is asked to sign in again when their current session runs out, and from then on they use SSO.
  • Forgot password still sends a reset email, but the new password can't be used to sign in while SSO is required. Tell your team to use Sign in with SSO.
  • SSO sign-ins count as two-factor sign-ins for the workspace two-factor rule, because your identity provider handles it.

The owner fallback ​

Workspace owners can always sign in with their email and password, even with Require SSO on. This is your way back in if your identity provider is down or misconfigured.

  • Keep at least one owner's password and two-factor working. Store the recovery codes somewhere safe.
  • Use the fallback only to fix SSO, then go back to signing in with SSO.

Each workspace has one owner. To hand the role to someone else, use Transfer ownership in Settings > Team and roles. See Roles and permissions.

Safety rules Infyva applies for you ​

  • Replacing the connection turns Require SSO off. When you click Replace and save a new identity provider, Require SSO switches off until someone signs in with SSO again. A broken new connection can't lock your team out.
  • Removing the last verified domain turns SSO and Require SSO off.
  • If your plan changes and no longer includes SSO, Require SSO stops applying and password sign-in works again.

Turn it off ​

  • To allow passwords again but keep SSO available, switch off Require SSO and click Save.
  • To stop using SSO, switch off Allow sign-in with SSO, or click Turn off and remove SSO in the Status panel and confirm Turn off and remove SSO? Your team will sign in with passwords again. Their accounts stay. People who only ever used SSO can set a password with Forgot password on the sign-in page.

Next steps ​