AnswerSettings & Workspaces
What do “Sign-in only via SSO” and “Join on first sign-in (JIT)” do?
Mandatory SSO sends every address on your verified domains to sign in through your identity provider; Google, email link and passkey then lead there. Owners are exempt, so a fault at the identity provider never locks you out. JIT makes people with a verified domain members automatically on their first SSO sign-in, with the role and access profile you choose for it.
- Mandatory SSO can only be turned on once the SAML connection is active and at least one domain is verified.
- Test signing in via SSO before you make it mandatory.
- If you remove the last verified domain, SSO sign-in no longer finds your organization and mandatory SSO switches off.
Next step
Sign-in & provisioningExplains this message
Mandatory SSO only works once the SAML connection is active.Mandatory SSO only works with at least one verified domain.Another organization has already verified this domain.This doesn't look like SAML metadata (EntityDescriptor is missing).Only an owner or admin of this organization can do that.
Did this solve your problem?
Your rating stays in this browser for now.
Not solved? Write to us.
Prepare an email to the Peak Atlas team. Your question and the articles you have already read are included. You confirm sending it in your email app.