Enforcing SSO
There are two ways to require single sign-on on a workspace.
| Switch | Where | Who it covers |
|---|---|---|
| Require single sign-on for everyone | Settings → Identity → Sign-in method | Every member of the workspace |
| Enforce SSO | On a provider, under Options | Only that provider's Email domains |
For a workspace that should have no password sign-in at all, use the first. The second is for a workspace where one company's domain must use SSO while other people, such as contractors, keep a password.
For anyone covered, every other sign-in method is turned off:
| Sign-in method | Enforced |
|---|---|
| Email and password, on the workspace or on the root login page | refused: the login page says the workspace requires single sign-on |
| Sign in with Google (social) | refused |
| Desktop app pairing | refused |
| MCP connector password form | refused |
| SSO | works |
When the whole workspace requires SSO, the login page shows only the single sign-on box, and the Forgot password and social buttons are gone.
Enforcement applies to this workspace only. The same person signs in to other workspaces however those workspaces allow.
What keeps you from locking yourself out
- Require single sign-on for everyone can't be turned on until an OIDC or SAML provider is enabled, and it stops applying while no provider is enabled. Disabling or deleting the last provider silently restores passwords; the Sign-in method panel says so when that happens.
- The owner recovery link works under either switch: a workspace owner can always get a short password window by email.
- The person turning it on is covered too. Sign in with SSO once before you turn it on.
Roll it out safely
- Get SSO working with enforcement off, and have everyone sign in once.
- Test the owner recovery link on this workspace.
- Turn on Require single sign-on for everyone, or tick Enforce SSO on the provider, and save.
- In a private window, confirm password sign-in is refused and SSO still works.
If some members' email domains aren't on any provider's Email domains list, keep one provider's list empty: a provider with no domains accepts any verified email, so those members still have somewhere to sign in.
The provider list on Settings → Identity shows SSO enforced (password login disabled) on an enforcing provider.