Admin
Require single sign-on
Turn off password sign-in for people on your SSO domains, so those accounts are added, removed and secured in one place — your identity provider.
Last updated: September 2026
What you'll need
| Tier | Professional |
| Platform | Web app |
| Permission | Owner or Administrator |
| Where | Administration → Organisation Settings → Security |
Single sign-on must already be set up and tested. See Set up single sign-on.
Before you turn it on
Require SSO applies to everyone whose email is on one of your SSO domains, owners included. Check these first:
- List every company domain your staff use under Email domains.
- Everyone on those domains has signed in with SSO at least once, so you know it works for them.
- Contractors on other addresses (for example a personal Gmail) keep password sign-in — they do not need to be on an SSO domain.
Turn on Require SSO
- Go to Administration → Organisation Settings → Security.
- Under Single sign-on (SSO), turn on Require SSO (disable password sign-in). It is available only while Enable SSO for this organisation is on.
- Select Save.
Expected result: the section's status shows SSO required.
What changes for your team
| Before | With Require SSO | |
|---|---|---|
| Password — email on a listed SSO domain | Yes | No — must use Continue with SSO |
| Password — email not on a listed domain | Yes | Yes — contractors keep password |
| Forgot password — on a listed domain | Yes | No |
| Forgot password — off domain | Yes | Yes |
| Continue with SSO | On listed domains | On listed domains — required there |
Turn it off
- On the Security tab, turn off Require SSO (disable password sign-in).
- Select Save.
Password sign-in works again for SSO-domain users straight away. Anyone who never set a password can create one with Forgot password.
Limitations
- Admins on an SSO domain have no password fallback. If your identity provider is unavailable, those people cannot sign in until it recovers. Contact support if you are locked out.
- People on other addresses are not covered by Require SSO. They keep password sign-in (and MFA, if your organisation requires it).
- Leaving Professional turns Require SSO off automatically, along with SSO itself. Password sign-in works again for everyone.
Frequently asked questions
Can an owner keep a password as a backup?
Not if their email is on an SSO domain. Require SSO blocks password sign-in for every listed domain, including owners and administrators.
Can a contractor on a personal email still sign in?
Yes. They will not see Continue with SSO unless you list their domain, and they keep password sign-in (and Forgot password).
We added a new email domain. Do people on it need anything?
Add the domain under Email domains on the Security tab and select Save before inviting them. Until then they sign in with a password, not SSO.
Does two-step verification still apply?
Only to password sign-in. People on SSO domains who must use SSO are not asked for a LambdaAssetCheck authenticator code — add a second factor at your identity provider instead. Contractors on password still follow your MFA policy.
Related articles
Was this page helpful?
