Articles in this section

Require SSO for an account

Anitha Abraham
Updated

After you set up single sign-on (SSO), users can still sign in to integrator.io with an email address and password. As the account owner or an administrator, you decide who must use SSO instead: everyone on the account at once, specific users for a partial rollout, and, if you're the owner, yourself. This article explains each setting, what changes when it's on, and what to do if your identity provider is unavailable.

Prerequisites:

Note: A user who belongs to more than one account must choose which account to use for SSO before they can sign in with it. Read the scenarios in Sign in with SSO so you can guide your users.

Require SSO for all users

This is the quickest way to require SSO account-wide, and the setting most accounts want. It applies to every user except the account owner.

  1. Go to Account avatar-icon.png, and then select Security.
  2. Under Single sign-on (SSO), select Require SSO for all users.
  3. Select Save.

While this setting is on, the per-user Require SSO setting disappears from the Users list and from the Invite user form, because SSO is already required for everyone; it comes back if you turn the setting off. Turning the setting on or off is recorded in the account's audit log, with who made the change and when (see View or download your audit logs).

Require SSO for specific users

Use the per-user setting for a partial rollout. It's available only while Require SSO for all users is off.

  • Existing users – Go to Account avatar-icon.png > Users, select the users, and turn on the toggle in the Require account SSO? column.
  • New users – On the Invite user form, turn on Require SSO under Security. If you invite several users to the same role in one invitation, the setting applies to all of them. For the invitation steps, see Invite and manage users to an account or environment.

Tip: The setting is also available for each user through the users API.

Require SSO for the account owner

The account owner can always sign in with an email address and password, even when SSO is required for every other user. Require SSO for account owner closes that last gap. Only the owner can turn it on or off, and it works whether or not Require SSO for all users is on.

Caution: Turning on this setting removes the owner's always-available password sign-in. Turn it on only after you've confirmed that SSO works and the owner's account has MFA enabled.

Why require SSO for the owner

  • Compliance – Security reviews such as SOC 2 or ISO 27001 may require proof that every sign-in goes through your identity provider. A standing password for the owner breaks that.
  • Consistent rules – Controls your identity provider enforces, such as MFA, device checks, and location limits, apply only to sign-ins that go through it.
  • Faster offboarding – When the owner role changes hands, turning off access in your identity provider fully locks out the previous owner only if no separate password still works.
  • Fewer passwords to protect – One less password on a highly privileged account that could be phished, reused, or leaked.

Before you turn it on

  • The owner's email must be on a domain your identity provider covers. If it isn't (a personal Gmail address, for example), the verification fails and you can't turn the setting on. In that case, keep the owner as your password-based backup, with a strong password and MFA.
  • The backup sign-in needs a company email address. Celigo doesn't allow personal or free email addresses, such as @gmail.com, for the owner, so you can't use one to work around the previous point.
  • You can't name a different backup user. The account owner is always the fallback for password sign-in.
  • The password sign-in URL differs by region. For the URL in each region, see Troubleshoot sign in.
  • Owners or admins of more than one Celigo account should check with their Celigo contact, because the settings can behave differently across accounts.

Turn on Require SSO for account owner

  1. Sign in as the account owner.
  2. Go to Account avatar-icon.png, and then select Security.
  3. Under Single sign-on (SSO), select Require SSO for account owner.
  4. Select Verify & Save. integrator.io verifies your identity with your provider, and then confirms that the setting is updated.

What stays the same

  • The password sign-in URL (?manualMode=true) still exists; it stops working for the owner while the setting is on.
  • API tokens work the same either way.

If your identity provider is unavailable

If your provider goes down while Require SSO for account owner is on, no one can sign in with a password. Contact Celigo Support (see Submit a support ticket); they can restore your access through an identity-verified process.