> ## Documentation Index
> Fetch the complete documentation index at: https://docs.borghq.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Mandatory SSO

> Require everyone on your verified domains to sign in through your identity provider

Mandatory SSO makes your identity provider the only way into Odin for people on your organisation's verified domains. When it is on, Odin blocks one-time codes, Google, GitHub and passkeys for those addresses, and ends existing sessions that did not come through your IdP.

Turn it on from **Organisation Settings → Single Sign-On** with **Require SSO for this organisation**. Only Owners and Admins can change it.

## Before you can turn it on

To protect against lockouts, the checkbox stays unavailable until Odin has seen a working SSO sign-in:

* An **Owner or Admin** must have signed in through the current connection within the last **15 minutes**.
* That person must still be an Owner or Admin when you turn the setting on.
* The connection must be **active**.

Sign-ins by ordinary members do not count, and do not cancel a recent Owner or Admin test.

<Steps>
  <Step title="Test SSO">
    In a private browser window, sign in through your IdP as an Owner or Admin.
  </Step>

  <Step title="Return to the settings">
    The help text under **Require SSO for this organisation** confirms the recent sign-in.
  </Step>

  <Step title="Confirm">
    Tick the checkbox, read the confirmation and select **Require SSO**.
  </Step>
</Steps>

## What changes when it is on

* **Blocked for verified-domain addresses**: one-time codes, passkeys, Google and GitHub. People who try them are told to use your identity provider.
* **Existing sessions end**: sessions from those methods stop working on the next request, and those people are sent to sign in again.
* **SSO keeps working**, both from Odin and from your IdP's dashboard.
* **People in several organisations**: if any organisation they belong to requires SSO for their email domain, they cannot use the other sign-in methods at all, and a session for one organisation's IdP cannot be reused in another.
* **Other domains are unaffected**: people whose email is outside the verified domains on the connection keep their usual sign-in methods.

## Locked while it is on

To stop an accidental lockout, you cannot **Disable**, **Reconfigure** or **Remove** the connection while mandatory SSO is on. Untick **Require SSO for this organisation** first. Fallback sign-in is then available again straight away.

## If your IdP is unavailable

Borg can still reach your workspace to help you recover. If an IdP outage or misconfiguration locks your team out, contact [mail@borghq.io](mailto:mail@borghq.io).

<Tip>
  Keep at least one Owner who can sign in through your IdP. If you plan an IdP migration, untick mandatory SSO, switch the connection, test, then turn it back on.
</Tip>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.