Once SSO is working you can turn off password sign-in for your whole account. Slack, SAML, and OpenID Connect all count as SSO here. Slack counts once Let users log in with Slack is ticked. JWT doesn't count.
Require SSO applies to everyone on your account, including the owner. Sign in with SSO yourself before you turn it on, because a password won't get you in afterwards.
Turning On Require SSO
- Head to Settings > Sign-in & access
- Under Single sign-on turn on Require SSO
- Click Save changes
What Changes While It's On
- Signing in: your login page only shows your SSO buttons, and passwords are refused on your account. People who are already signed in stay signed in.
- Password reset: someone whose every HelpDocs account requires SSO gets no reset email, and a reset link sent before you turned it on stops working. Someone who also belongs to an account that allows passwords can still reset theirs, but it won't be accepted on your account.
- Invitations: an invitation link sends anyone who isn't signed in to your login page, and signing in with SSO accepts the invitation. Someone who's already signed in can accept it as usual. Nobody can set a password from an invitation.
- People in other HelpDocs accounts: if someone's login also belongs to accounts your identity provider doesn't cover, their SSO sign-in can be refused. The error page tells them to log in from one of their other accounts, then come back.
When It Stops Applying
Require SSO only applies while SSO is available. If you disconnect your last provider, or your plan no longer includes SSO, passwords work again. If the setting is still on when you reconnect, it applies again.
Locked out because your identity provider stopped working? Account admins can contact support to have Require SSO turned off.