Require Single Sign-On

On Optional, people choose between their password and your sign-in. On Required, a password no longer opens your organization's work. Everyone, Admins included, comes in through your identity provider.

This is the one step in single sign-on that can lock people out, so Tamaat checks a list first and asks you to name a recovery person.

Open the list

In Settings, under Organization → Single sign-on, find Sign-in policy. Beside Required ("Single sign-on only"), choose "Require single sign-on".

The page "Before you require single sign-on" lists what must be true. Each line reads "Ready" or "Not ready".

Line	How to make it ready
"Requiring single sign-on is available here"	Nothing to do. If it reads "Not ready", requiring single sign-on is not available to you, and "Require single sign-on" at the bottom of the page stays unavailable. Stay on Optional.
"A connection is enabled"	Enable a connection. See Set Up Single Sign-On.
"Every enabled connection passed its test"	Choose "Test connection" on each active connection.
"Your identity provider states when each person signed in"	The last test must show "Sign-in time received". If it does not, your provider has to be set to send it.
"A recovery person is set"	See the next section.
"You signed in through the connection in this session"	Choose "Sign in" on that line and sign in at your provider. You come back to Single sign-on; choose "Require single sign-on" again and the line reads "Ready". This proves the switch is thrown by someone it will not lock out.

Name the recovery person

The recovery person is, in the words of the page, "The one Admin who can still change these settings with their own password and second step if your identity provider is unavailable."

• The role is taken, never given. The Admin who will hold it chooses "Make me the recovery person" themselves.
• They need a Tamaat password and two-factor authentication. If the button is not available, the page says "To take this role, sign in with your password and your second step." Turn on two-factor under Account → Security & sign-in, sign in with it, and come back.
• There is one recovery person at a time. Taking the role from someone else asks first: "You become the only person who can change these settings with a password. The current recovery person loses that."

The recovery person's password opens these settings and nothing else of the organization. For everyday work they sign in through your organization like everyone else.

While single sign-on is required, the recovery person cannot be removed from the organization or lose the Admin role. Tamaat says "This person is the recovery person for an organization that requires single sign-on. Choose another recovery person first."

Read what changes

Under "What changes" the page states three things:

• "Everyone signs in through your organization to open its work, including Admins."
• "People signed in with a password are asked to sign in through your organization the next time they open its work."
• "Only the recovery person can open these settings with a password."

Two counts follow: "People", and how many of them "Have not signed in through your organization yet". The second number is the people who will meet your sign-in for the first time. If it is large, tell them before you switch.

Then: "These carry nobody’s sign-in and keep working:" "API keys", "Application keys", "Service tokens" and "Schedules", each with a count. Requiring single sign-on does not stop them.

Confirm

1. 1

   When every line reads "Ready", choose "Require single sign-on".

2. 2

   "Require single sign-on?" warns: "Password sign-in stops opening this organization’s work as soon as you confirm."

3. 3

   Type the organization's name exactly as shown, then choose "Require single sign-on".

Sign-in policy now reads Required, "Single sign-on only", with the recovery person's name beside it.

While it is required

• People sign in again each hour. A sign-in through your organization counts for one hour from the moment the person signed in at your provider. After that Tamaat asks: "Your organization sign-in is no longer recent enough. Sign in with your organization again to continue."
• A password session is refused. Someone signed in with a password sees "This organization requires single sign-on. Sign in with your organization to open its work."
• Other workspaces are not affected. The rule covers your organization's work only. See Sign In With Your Organization.
• Your last connection stays. You cannot disable the only connection people sign in through: "Single sign-on is required and this is the only connection in use. Stop requiring single sign-on before you disable it."
• Changed settings need the sign-in time. A new version of a connection can be enabled only if its test shows "Sign-in time received".

If your identity provider is unavailable

Nobody can sign in through your organization while your provider is down, and nobody's password opens its work. The recovery person can still repair the settings:

1. The recovery person signs in to Tamaat with their password and second step.
2. They open Settings, Organization → Single sign-on.
3. They fix the connection, or choose "Stop requiring" so passwords work again.

Requiring single sign-on never switches itself off.

Stop requiring

Under Sign-in policy, choose "Stop requiring". "Stop requiring single sign-on?" tells you the effect: "People can sign in with a password or single sign-on again." The policy returns to Optional. Your connections and the links people have made stay as they are.

Next steps

1. Tell members what they will see
2. Remove someone's access
3. Look up a refused sign-in