# Enforce SSO and disable local logins in a SaaS app Source: https://startwithidentity.com/recipes/enforce-sso-disable-local-logins/ Last updated: 2026-11-05 License: content by Start with Identity. Cite the source URL. --- Enforcing SSO means the app's own login stops working for everyone except a short list you choose, so the IdP's MFA, [conditional access](https://startwithidentity.com/glossary/conditional-access/), and deprovisioning apply to every session. The work is five moves: turn on the app's require-SSO switch, keep one or two [break-glass](https://startwithidentity.com/glossary/break-glass/) admins outside it, sign everyone out so old password sessions die, revoke or SSO-gate personal API tokens, and alert on any non-SSO sign-in. This recipe uses GitHub, Atlassian Cloud, and Slack as worked examples; the pattern applies to any app with an [SSO enforcement](https://startwithidentity.com/glossary/sso-enforcement/) setting. The reason is the 2024 [Snowflake customer tenant campaign](https://startwithidentity.com/breaches/incidents/2024-snowflake-customer-tenant-campaign/): attackers signed in to about 165 customer accounts with infostealer-harvested passwords, and Mandiant found the affected accounts lacked MFA. Every one of those sign-ins was a local, single-factor login the identity provider never saw. ## Before you start: list every way in | Path | GitHub | Atlassian Cloud | Slack | | --- | --- | --- | --- | | Enforcement setting | Org or enterprise "Require SAML SSO" | Authentication policy "Enforce single sign-on" | "Required for all members" | | Built-in bypass | SSO recovery codes; EMU setup user | Users in a non-SSO policy | Workspace and Org Owners | | Token side door | Classic PATs, SSH keys | User API tokens | Existing sessions | | Plan needed | Enterprise Cloud | Atlassian Guard Standard | Business+ or Enterprise | Check the app's row in the [MFA matrix](https://startwithidentity.com/tools/mfa-matrix/) for documented exceptions, and see the [local login bypass](https://startwithidentity.com/glossary/local-login-bypass/) entry for the wider list. If the plan you need costs more, that is the [SSO tax](https://startwithidentity.com/glossary/sso-tax/). ## 1. Create the break-glass accounts first Pick one or two admin accounts that will stay outside SSO. Give each a FIDO2 security key, a long random password in a sealed vault, and no daily use. The [Entra break-glass recipe](https://startwithidentity.com/recipes/entra-break-glass-accounts/) shows the same pattern for the IdP itself. - **GitHub org:** after enforcement, save the SSO recovery codes. For [Enterprise Managed Users](https://docs.github.com/en/enterprise-cloud@latest/admin/concepts/identity-and-access-management/setup-user), the setup user (`_admin`) cannot use SSO and needs 2FA plus a recovery code for enterprise settings. - **Atlassian:** Atlassian's [authentication policy settings](https://support.atlassian.com/security-and-access-policies/docs/authentication-policy-settings-for-your-organizations/) say to "create another policy for those users that does not require SSO to login." Put only the break-glass admins in it. - **Slack:** owners already bypass SSO, so reduce owners to the break-glass people. **Check:** each break-glass account signs in with its key from a clean browser. **Common failure:** the break-glass admin is also an IdP user, so enforcement captures it. **Rollback:** none needed; these accounts are your rollback. ## 2. Turn on enforcement **GitHub** ([enforcing SAML SSO](https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-saml-single-sign-on-for-your-organization/enforcing-saml-single-sign-on-for-your-organization)): ``` Organization > Settings > Authentication security [x] Require SAML SSO authentication for all members of the ORG organization > Remove members and require SAML single sign-on ``` Requiring SAML at the enterprise level overrides organization settings for every org. On enforcement, members without a linked IdP identity are removed, including bots and service accounts; they regain prior access if they rejoin within three months. **Atlassian:** `Security > User security > Authentication policies > Edit > Enforce single sign-on`. We recommend enabling it on a test policy with a few users first, then on the policy that covers everyone else. **Slack** ([SAML SSO setup](https://slack.com/help/articles/203772216-Set-up-SAML-single-sign-on-for-Slack)): workspace path `Admin > Workspace settings > Security > SSO & authentication`; Enterprise org path `Tools & settings > Organization settings > Security > SSO Settings`. Choose "required for all members", or "required for all members excluding guests" if guests sign in with email and password. **Check:** a normal member account gets redirected to the IdP and the app's password form no longer accepts their credentials. **Common failure:** on GitHub, a CI bot account disappears from the org because it has no IdP identity; move automation to a GitHub App first. **Rollback:** clear the checkbox, or set the Atlassian policy or Slack setting back to optional. ## 3. End sessions that started with a password Enforcement does not always sign people out. Slack says members already signed in "will remain signed in." - **Slack:** `SSO & authentication > Force session reset and rebind SSO > Reset`, then choose to sign out members who have not enabled SSO or everyone ([reset SSO sessions](https://slack.com/help/articles/206924507-Reset-all-single-sign-on-sessions)). Choosing everyone signs you out too. - **Atlassian:** on the policy's Settings or Members page, select **Reset sessions**; members are logged out in about ten minutes. - **GitHub:** members without a linked identity are removed at enforcement; per member, owners can revoke **Active SAML sessions** under People. **Check:** the app's audit log shows a sign-in through SSO for each active user after the reset. **Common failure:** resetting during working hours without notice floods the helpdesk; announce it. **Rollback:** not reversible, and it should not need to be. ## 4. Close the token side doors Tokens authenticate without a browser, so SSO never sees them. - **GitHub:** classic PATs and SSH keys must be [authorized for SSO](https://docs.github.com/en/enterprise-cloud@latest/authentication/authenticating-with-single-sign-on/authorizing-a-personal-access-token-for-use-with-single-sign-on); fine-grained tokens are authorized at creation. Review and revoke them under `People > member > Authorized credentials > Revoke` ([managing SAML access](https://docs.github.com/en/enterprise-cloud@latest/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization)). Revoking removes only the SAML authorization; the token still exists. - **Atlassian:** in the policy, set **User API tokens** to "Block members from creating a new or using an existing API token", or cap expiry (the default is one year). Changes apply on the next API call. - **Any app:** list app passwords, legacy API keys, and personal tokens, then move integrations to service accounts or app installations with an owner. **Check:** a pre-existing personal token fails against the org's API after revocation. **Common failure:** a nightly job breaks because it ran on an engineer's personal token. That job was a bypass; give it its own identity. **Rollback:** reissue a token for the specific integration only. ## 5. Alert and review Send the app's audit log to your SIEM and alert on any sign-in that is not SSO, any change to the enforcement setting, and any use of a recovery code. Review the break-glass list and token inventory quarterly (a recommendation, not a vendor requirement). **Check:** sign in as a break-glass admin and confirm the alert fires within minutes. **Common failure:** the alert keys on a username that changes; key it on the account's stable ID. **Rollback:** not applicable. ## Verify it works - Sign in as a regular user in a private window: the app redirects to the IdP, and the password form rejects the user. - Disable a test user in the IdP and confirm they cannot open the app within the session lifetime you set. - Call the API with an old personal token: GitHub refuses it for the org's resources, and Atlassian rejects a blocked token. - Sign in as each break-glass account: it works, and your SIEM records the alert. - Export the member list and confirm every human account has a linked IdP identity. ## Related - [SSO enforcement](https://startwithidentity.com/glossary/sso-enforcement/) and [local login bypass](https://startwithidentity.com/glossary/local-login-bypass/) - [Break-glass accounts in Entra ID](https://startwithidentity.com/recipes/entra-break-glass-accounts/) - [Phishing-Resistant MFA Support Matrix 2026](https://startwithidentity.com/reports/phishing-resistant-mfa-matrix-2026/) and the [MFA matrix tool](https://startwithidentity.com/tools/mfa-matrix/) - [SCIM provisioning from Entra and Okta to SaaS](https://startwithidentity.com/recipes/scim-provisioning-entra-okta-saas/) - [Orphaned account abuse](https://startwithidentity.com/techniques/orphaned-account-abuse/)