Enforcing SSO login makes it so users with specific roles are not allowed in your IXON Cloud company unless they are logged in through SSO. This enables you to enforce a consistent level of account security for all your users by managing their login requirements from inside your Identity Provider (IdP), for example with a password policy and two-factor authentication (2FA).

For users that simply cannot log in through SSO, depending on their own login capabilities and your IdP configuration, you can still increase account security by enforcing 2FA for the e-mail address + password login method.

• Preparation
• Enforce SSO login
• Disable e-mail address and password login fields

Preparation

There are a few preparation steps.

1. A custom domain is required. Make sure you have one set up.
2. SSO login on custom domain is required as well. Make sure you have it set up.

Enforce SSO login

Once you have configured a custom domain and SSO login on your custom domain, you can proceed with the steps below to enforce SSO login.

3. Open your custom domain in your browser.
4. Log in using SSO.
   • If you skip this step, you will not be able to enforce SSO. You need to be logged in with SSO yourself to be able to enforce it for other users.
   • If you are already logged in with e-mail address and password, you'll need to log out first.
5. Go to Admin > Roles, open a role, and add Enforce Single Sign-On to it.
   
   • Repeat this for every role where you wish to enforce SSO.
   • If this option is greyed out, you are probably not logged in using SSO. Please first do the previous step.

Disable e-mail address and password login fields

This step is optional. In addition to having enforced SSO, you can also remove the e-mail address and password login fields from your custom domain's login page altogether. This simplifies the user experience, because the only login method that your users will be confronted with, is the SSO login method.

6. Make sure that all your users can log in using SSO by double-checking the previous steps before continuing.
7. Go to Admin > Identity.
8. Under Portal settings, at Login options, you can turn off E-mail address and password.
   • If the login options are not available, you are probably not on your custom domain.