SSO-Only Mode & the Break-Glass Account
Who this guide is for: Tenant administrators who want every member of their organization to sign in exclusively through their identity provider (SAML or OIDC), with a single recovery account that can still use a password if the IdP ever fails.
When SSO-only mode is on, the local email & password login is disabled for everyone in your tenant. The login page shows only the Sign in with SSO button. The one exception is the break-glass account — a designated admin who can always sign in with a password, so you are never locked out.
SSO-only mode is off by default. Nothing changes for your users until you turn it on.
Before you begin
You must have both of the following in place before SSO-only mode can be enabled — the toggle stays disabled until they exist:
- An enabled identity provider. Configure SAML or OIDC first (see SSO Setup) and make sure it is enabled.
- A break-glass account. Designate one active admin who has a local password set (see below).
This two-condition guard exists so a tenant can never accidentally lock itself out: there is always a working IdP and always a password-based way back in.
Step 1 — Designate a break-glass account
- Go to Admin → Settings → User Management → SSO.
- Scroll to the SSO-only mode section.
- Under Break-glass account, choose an active admin from the dropdown.
- The admin must have a local password set. Admins who only sign in via SSO (no password) appear greyed out and cannot be selected.
- Click Set as break-glass.
Only one break-glass account can exist at a time. Designating a new one replaces the previous designation. The change is recorded in the audit log.
Step 2 — Turn on SSO-only mode
- In the same section, toggle Require SSO for all members on.
- From now on, all members (except the break-glass account) must sign in through your identity provider.
To turn it back off, toggle it again — disabling is always allowed and has no preconditions.
Configuration reference
| Setting | Where | Default | Effect |
|---|---|---|---|
| Break-glass account | Admin → Settings → User Management → SSO | None | The single admin allowed to sign in with a password while SSO-only is on |
| Require SSO for all members | Admin → Settings → User Management → SSO | Off | Disables local password login tenant-wide (break-glass exempt) |
How it behaves at sign-in
- Regular users: the login page hides the email/password fields and shows only Sign in with SSO. A password submitted by any other means is rejected server-side.
- Break-glass account: can always sign in with its email and password, even
while SSO-only mode is on. Every break-glass sign-in writes a flagged entry
(
break_glass_login) to the audit log so SSO-bypass logins are always traceable. - Failsafe: if SSO-only is on but no enabled IdP is detected at the login page, the password form is shown anyway — a misconfiguration can never strand your members on a button that goes nowhere.
Security & compliance notes
- The break-glass mechanism satisfies the SSO-lockout recovery control (PRD §5.1.1). Keep the break-glass credentials safe and rotate them periodically.
- All changes (designating a break-glass account, enabling/disabling SSO-only) and every break-glass login are written to the audit log (SOC 2 CC6.3).
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| The Require SSO toggle is disabled | No enabled IdP, or no break-glass account | Enable an IdP and designate a break-glass account first |
| An admin is greyed out in the break-glass dropdown | That admin has no local password | Have them set a password, or choose a different admin |
| A member reports they cannot log in after enabling SSO-only | They were using a local password | They must now use Sign in with SSO; only the break-glass account keeps password login |
| You are locked out and SSO is down | IdP failure | Sign in with the break-glass account’s email + password, then fix or disable the IdP |