SSO Enforcement

SSO enforcement is an application setting that makes single sign-on through the organization's identity provider the only way to sign in, disabling or removing local passwords, social login and other sign-in methods for members of the organization. Offering SSO and enforcing it are separate things: an app can support SAML while still letting every user log in with a local password that the identity provider never sees.

GitHub's documentation is a clear example of the difference. Its organizations can configure SAML SSO, and separately enforce it: "all members of the organization must authenticate through your IdP", and members who have not are removed. Enforcement is what makes IdP controls such as phishing-resistant MFA, conditional access and deprovisioning apply to the app. In SWI's Phishing-Resistant MFA Support Matrix 2026, the notes for 12 of 95 apps document a setting that makes SSO the only way in, and in 9 apps turning it on also switches off the app's own passkeys, so the account becomes exactly as strong as the IdP policy for that app. Check each app's row in the MFA matrix and inventory the exceptions that remain.

See also: local login bypass, SSO tax, break-glass account, authentication policy, SSO, SAML 2.0