Cloud · Single sign-on · 08
Require single sign-on
Send everyone on a domain to your identity provider, without a password option.
Requiring single sign-on sends everyone with an address on a domain straight to your identity provider, with no password to fall back on. It's how you make sure that turning off someone's work account turns off their access to Zym Labs. Only owners can require it, and you'll be asked to confirm it's you.
How it works
When you require it, members and admins on the domain lose their Zym Labs password and are signed out. Next time, each signs in with your identity provider and confirms once by email, which links their account to it. Owners keep a password, so the organization can't be locked out.
Stop requiring makes single sign-on optional again, but the passwords it removed stay removed: people set new ones if they want them.
Before you start
- An active connection that someone has signed in through. See Test a connection.
- An owner who can sign in without single sign-on: with a passkey, or a password and a second step. If none can, Cloud says so and won't let you require it. See Keep your account secure.
- Tell your team: they're signed out when you require it.
Steps
Open the connection
Open Single sign-on, then the connection.
Require it
Under Enforce SSO for your domain, choose Require followed by the connection's name. Cloud says how many people will lose their password and be signed out.
Confirm
Choose Require again to confirm, and confirm it's you. Cloud shows its progress as it removes passwords and signs people out.
What's next
- Choose how members sign in: single sign-on only, for the whole organization.
- Troubleshoot single sign-on: when someone can't sign in.