Skip to main content
Mandatory SSO makes your identity provider the only way into Odin for people on your organisation’s verified domains. When it is on, Odin blocks one-time codes, Google, GitHub and passkeys for those addresses, and ends existing sessions that did not come through your IdP. Turn it on from Organisation Settings → Single Sign-On with Require SSO for this organisation. Only Owners and Admins can change it.

​
Before you can turn it on

To protect against lockouts, the checkbox stays unavailable until Odin has seen a working SSO sign-in:
  • An Owner or Admin must have signed in through the current connection within the last 15 minutes.
  • That person must still be an Owner or Admin when you turn the setting on.
  • The connection must be active.
Sign-ins by ordinary members do not count, and do not cancel a recent Owner or Admin test.
1

Test SSO

In a private browser window, sign in through your IdP as an Owner or Admin.
2

Return to the settings

The help text under Require SSO for this organisation confirms the recent sign-in.
3

Confirm

Tick the checkbox, read the confirmation and select Require SSO.

​
What changes when it is on

  • Blocked for verified-domain addresses: one-time codes, passkeys, Google and GitHub. People who try them are told to use your identity provider.
  • Existing sessions end: sessions from those methods stop working on the next request, and those people are sent to sign in again.
  • SSO keeps working, both from Odin and from your IdP’s dashboard.
  • People in several organisations: if any organisation they belong to requires SSO for their email domain, they cannot use the other sign-in methods at all, and a session for one organisation’s IdP cannot be reused in another.
  • Other domains are unaffected: people whose email is outside the verified domains on the connection keep their usual sign-in methods.

​
Locked while it is on

To stop an accidental lockout, you cannot Disable, Reconfigure or Remove the connection while mandatory SSO is on. Untick Require SSO for this organisation first. Fallback sign-in is then available again straight away.

​
If your IdP is unavailable

Borg can still reach your workspace to help you recover. If an IdP outage or misconfiguration locks your team out, contact [email protected].
Keep at least one Owner who can sign in through your IdP. If you plan an IdP migration, untick mandatory SSO, switch the connection, test, then turn it back on.