Enforce SSO (Turn Off Password Sign-In)
With Enforce SSO (disable password login) on, your people must sign in through your identity provider. Their MSPCFO password stops working.
1. Make sure the configuration is Verified
The Enforce SSO checkbox can't be ticked until the configuration is Verified (see Run a Test Sign-In). This prevents a mistake in the settings from locking everyone out.
2. Turn on enforcement
On the Single Sign-On page, choose Edit, tick Enforce SSO (disable password login), and choose Save changes.
[SCREENSHOT: Edit form with Enforce SSO ticked]
What enforcement does
- A correct password is refused with:"Your organization requires SSO login. Please use "Sign in with SSO"."A wrong password gets the normal invalid-login message. Repeated refused attempts count toward account lockout, the same as wrong passwords.
- Anyone already signed in with a password is signed out on their next page and asked to sign in with SSO.
- Automatic sign-in after a password reset or after accepting an invitation is also stopped. Those people sign in with SSO instead.
Who isn't affected
- People who belong to more than one MSPCFO company keep password sign-in and two-factor authentication.
- MSPCFO staff are always exempt, so MSPCFO Support can still reach your account.
- API keys and API integrations keep working, because they don't use browser sign-in.
Turning enforcement off
Untick Enforce SSO and save. Password sign-in works again straight away.
People who never set an MSPCFO password (accounts created by SSO) can use I forgot my password on the sign-in page to set one.
0 Comments
Add your comment