---
title: Force SSO
slug: user-guide-10x/force-sso
docTags: 
createdAt: 2025-06-18T11:01:36.094Z
---

Force SSO (Single Sign-On) is a security feature that mandates users log in exclusively through an SSO provider, enhancing security and simplifying access. It centralizes authentication, reducing the need for passwords while ensuring compliance with organizational policies. Specific users can be exempted if alternative access is required.

Note:

When enabling Force SSO, ensure that the Admin is exempted from this setting. Otherwise, the Admin will not be able to log in using credentials in the future, and only SSO will be available for authentication.

If a user attempts to log in using credentials while Force SSO is enabled, an authentication error will occur.

## Enable Force SSO

1. Navigate to **Session & Security** → **AUTHENTICATION** → **SAML Settings**.
2. Toggle ON **Force SSO**.

When Force SSO is enabled at the account level, most users must log in via SSO. However, specific users can be exempted from this requirement, even if they belong to the same account.

## Exempt a User from Force SSO

1. Navigate to Users, **Groups & Roles** → **Users**.
2. Click **Create a New User**.
3. In the Create User window:
4. Toggle ON the **Exempt Force SSO** option.

   ::Image[]{src="https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/bRf3T2_ouEldLfWH-wXh1_exemptforcesso.png" size="28" width="639" height="865" position="center" showCaption="false"}
5. Select **Notify via Email** to send an email notification.

   ::Image[]{src="https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/FrYQsvsDgIFamkgQFosC__notifyviaemail.png" size="34" width="633" height="858" position="center" showCaption="false"}

Behavior When Exempting Users

If the **Exempt Force SSO** toggle is enabled:

- The admin creating the user receives an email with a password link for the user.
- The password field is disabled by default. If you manually set a password, the toggle is enabled automatically.
- If **Notify via Email** is toggled OFF, an email is sent without the password link.

## Edit an Existing User’s Force SSO Exemption

1. Navigate to **Users**, **Groups & Roles** → Select the desired user.
2. In the **Groups & Roles** window, toggle ON the **Exempt Force SSO** option.

   ::Image[]{src="https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/Stle9V3b7vvm7DIYykdwB_forceexemptsso.png" size="54" width="1848" height="715" position="center" showCaption="false"}
3. Go to the **Password** tab and set a password.

   ::Image[]{src="https://api.archbee.com/api/optimize/511c8QBH-VHiwWnyzIwUb/l9PDv45yifnhYvN0QFEKO_givepassword.png" size="60" width="1852" height="719" position="center" showCaption="false"}