Local Login Bypass

A local login bypass is any way into an SSO-protected application that does not go through the identity provider: an owner or admin account that keeps a password, a social login that skips SSO, an API token or a break-glass account. Because the IdP never sees these sign-ins, none of its controls (phishing-resistant MFA, conditional access, session revocation, deprovisioning) apply to them.

SWI uses the term in the Phishing-Resistant MFA Support Matrix 2026, which documents bypass paths next to SSO in widely used apps: HCP Terraform owners can bypass SSO, Linear's top role can still log in by any method, 1Password Owners still sign in with their account password and Secret Key, Grafana Cloud exempts social-login users from enforced MFA, and Coda's 2FA covers only email and password logins. Attackers look for exactly these doors, since one owner account with a phishable password undoes an SSO rollout. The fix is to enable SSO enforcement where the app offers it, keep the unavoidable exceptions to named break-glass accounts with security keys stored offline, alert on every local sign-in, and review the list quarterly. The MFA matrix notes column records each app's known exceptions.

See also: SSO enforcement, break-glass account, phishable MFA, social login, orphaned account abuse, SAML 2.0