Skip to content
Tallyfy
Developers

SSO enforcement

Make SSO the only way in

Section titled “Make SSO the only way in”

Enforcement locks your organization down so members sign in only through your identity provider. Email and password logins are turned off for members whose email is on one of your verified domains, owners and admins included, and manual invites for those addresses are blocked, so they all come through SSO. On a connection you set up yourself, people on other domains keep password login and can still be invited. On a connection Tallyfy support set up for you, enforcement covers every member, whatever their domain, and blocks every manual invite. Enforcement only applies to someone when every Tallyfy organization they belong to requires SSO of them, so a person who also belongs to an organization whose enforcement doesn’t cover them keeps password login. You turn it on with the Require SSO switch under Settings > Organization > Security > SSO, on any paid plan.

There’s no password fallback for the owners and admins it covers. If your identity provider goes down or a config change breaks SSO, nobody enforcement covers can sign in with a password until SSO works again or enforcement is off. Read the recovery steps below before you turn it on.

What enforcement changes

Section titled “What enforcement changes”

When Require SSO is on:

  • Email and password logins are turned off for members on your verified domains, owners and admins included
  • Manual invites for addresses on your verified domains are blocked, so those new members arrive through your IdP
  • On a connection you set up yourself, people on other domains keep password login and can still be invited by hand
  • Someone who also belongs to another Tallyfy organization that doesn’t require SSO of them keeps password login
  • Members it covers who use the regular login page are sent to sign in through your identity provider

On a connection Tallyfy support set up for you, enforcement covers every member, whatever their domain.

You need a verified domain first

Section titled “You need a verified domain first”

The Require SSO switch stays disabled until you have a verified domain. That’s deliberate. Enforcing SSO without proof that you own your email domain is risky, so Tallyfy gates it behind verification. If the switch is greyed out, go verify a domain first. See Domain verification.

Turn on enforcement

Section titled “Turn on enforcement”

Before you flip the switch, confirm SSO actually works: run the connection test in the wizard and do a real test login. Enforcement is a safety-sensitive change, so Tallyfy adds a couple of guardrails when you turn it on.

  1. Go to Settings > Organization > Security > SSO and make sure your connection is enabled and tested.
  2. Turn on the Require SSO switch.
  3. Read the confirm box. It says members who must use SSO, owners and admins included, can only sign in through your identity provider, with no password fallback. Click Require SSO to confirm.
  4. Tallyfy emails every admin in your org that enforcement changed, and records the change in your system log.

Turning enforcement on doesn’t kill people’s active sessions mid-work. New sign-ins go through SSO from that point on.

Can admins still sign in with a password?

Section titled “Can admins still sign in with a password?”

Not if enforcement covers them. Owners and admins follow the same rule as everyone else:

  • Members on your verified domains, owners and admins included, can only sign in through SSO once enforcement is on.
  • On a connection you set up yourself, an admin whose email isn’t on one of your verified domains isn’t covered, so they still sign in with a password.
  • An admin who also belongs to another Tallyfy organization that doesn’t require SSO of them isn’t covered either, and still signs in with a password.

So if your IdP has an outage or a misconfiguration breaks SSO sign-in, the people enforcement covers can’t get in until SSO works again or someone turns enforcement off. A password reset doesn’t help. It doesn’t sign you in, and it signs you out of any session you still have open.

Recover from a broken IdP

Section titled “Recover from a broken IdP”

If SSO stops working while enforcement is on:

  1. An admin who can still get in turns Require SSO off under Settings > Organization > Security > SSO. That’s an admin who’s still signed in, since enforcement doesn’t end open sessions, or, on a connection you set up yourself, an admin whose email isn’t on one of your verified domains. Members can use password login again at once.
  2. If no admin can get in, contact Tallyfy Support. Support can turn enforcement or SSO off for your organization.
  3. Once you’re in, check the connection. Re-run the test to see the specific error.
  4. Fix the cause, then turn Require SSO back on. A common cause is a signing certificate your IdP replaced, which you re-upload or re-import via the metadata URL.

Turn enforcement off

Section titled “Turn enforcement off”

You can lift enforcement at any time from the same switch. It applies at once, with no confirm box, and Tallyfy emails every admin. With enforcement off, members can use password login again, and the change is recorded in your system log like other SSO changes.

Troubleshooting

Section titled “Troubleshooting”
  • The Require SSO switch is disabled - you don’t have a verified domain yet. Verify one under the Domains tab.
  • A member is stuck at login - confirm they’re assigned to the app in your IdP and they’re using the SSO URL. Members on your verified domains, admins included, can’t use password login under enforcement, unless they also belong to another Tallyfy organization that doesn’t require SSO of them.
  • Nobody can sign in - if your IdP is down and enforcement covers every admin, a password or a password reset won’t get anyone in. Contact Tallyfy Support to turn enforcement off, as in the recovery steps above.
  • Changes you didn’t expect - every admin gets an email when enforcement changes, and each change is recorded in your system log.
Section titled “Related articles”
Get in touch
About Tallyfy