# Require SSO

> Require members to sign in through Microsoft Entra ID: prerequisites, the owner break-glass, effect on existing sessions, and Botyard two-factor after SSO.

Canonical URL: https://docs.botyard.io/docs/sso/require-sso

The **Sign-in policy** card on **User menu** › **Settings** › **General** › **Single sign-on** has two settings:
**Require SSO** and **Also ask for Botyard two-factor after SSO**. Only organization owners can
change them.

## Require SSO

With **Require SSO** on, members must sign in through your identity provider to use this
organization. A session started another way, with a Botyard password, magic link, passkey or Google,
can't reach the organization. It works only in the policy's own organization: the same person can
still use other Botyard organizations they belong to.

### Before you can turn it on

The switch stays disabled until every prerequisite holds. Under **Before you can require SSO**, the
card lists any that don't:

| Prerequisite                                      | What the card says                                                                     |
| ------------------------------------------------- | -------------------------------------------------------------------------------------- |
| An active identity provider connection            | Connect an identity provider and make sure it's enabled.                               |
| You signed in through it, in your current session | Sign out and sign back in through your identity provider, so we know it works for you. |
| **Require MFA** is off                            | Turn off “Require MFA” — your identity provider enforces MFA for SSO sign-ins.         |

**Require MFA** is under **User menu** › **Settings** › **General** › **Security**. Configure MFA in Entra,
for example with Conditional Access, instead.

### Turning it on

Turn on **Require SSO** and confirm **Require SSO for everyone?**.

* Nobody is signed out. From their next request, members who didn't sign in through your identity
  provider lose access to the organization until they do.
* Sessions that did come through your identity provider keep working.

### Owner break-glass

Owners who signed in with Botyard MFA keep access while SSO is required. That way an owner can
still get in, and turn **Require SSO** off, if your identity provider is unavailable or
misconfigured. Each break-glass access is recorded in the audit log.

Make sure at least one owner has a Botyard authenticator set up before you require SSO.

### While SSO is required

You can't disable or disconnect the identity provider connection, because that would lock members
out. Turn off **Require SSO** first.

## Also ask for Botyard two-factor after SSO

By default, your identity provider owns MFA: an SSO sign-in is not asked for a Botyard two-factor
code.

When you turn on **Also ask for Botyard two-factor after SSO**, members who have set up a Botyard
authenticator are asked for their code after signing in through your identity provider. Members
without one are not asked, and that includes everyone created through SSO or SCIM provisioning.
To require MFA for everyone, enforce it in Entra.