Enforcing SSO
Tick Enforce SSO on a provider to require SSO for its Email domains on that workspace. Then, for those addresses:
| Sign-in method | Enforced |
|---|---|
| Email and password | refused: the login page says the workspace requires single sign-on |
| Sign in with Google (social) | refused |
| Desktop app pairing | refused |
| SSO | works |
Enforcement applies to this workspace only. The same person signs in to other workspaces however those workspaces allow.
Roll it out safely
- Get SSO working with enforcement off, and have everyone sign in once.
- Test the owner recovery link on this workspace.
- Tick Enforce SSO and save.
- In a private window, confirm password sign-in is refused for your domain and SSO still works.
The provider list on Settings → Identity shows SSO enforced (password login disabled) on an enforcing provider.