Skip to main content

Owner recovery

If SSO is enforced and your identity provider is down or misconfigured, a workspace owner can still get in.

  1. On your workspace's login page, click Workspace owner locked out by SSO? Email a recovery link, and enter the owner's email.
  2. If that address belongs to an active owner, Waxell emails a sign-in recovery link, branded like the rest of your workspace. The page shows the same message either way, so it can't be used to discover who is an owner.
  3. The link works once, for 15 minutes.
  4. Opening it allows a password sign-in for the next 15 minutes. Sign in, and fix the provider or turn enforcement off.

Recovery only exists while Enforce SSO is on for that email's domain. If it isn't, the page says so and nothing is sent: people can already sign in with a password. While you're still setting SSO up, you don't need it.

Only owners can use it: admins and members can't. Requesting and using a link are both recorded in the audit log.

The owner needs a Waxell password for this to work. Set one before you enforce SSO.