Require SSO for members

You need SAML set up for the team.

Turn it on

In the team’s Single sign-on (SAML) settings, turn on Require SSO for members and save. Members, but not the owner, can then sign in only through this team’s IdP. A password, a passkey, the server’s OIDC or another team’s IdP gets “Your team requires single sign-on”.

• Every member is signed out, and signs in again with SSO.
• The owner keeps password sign-in, so a broken IdP setup can always be fixed.

Caution

This isn’t offboarding. Removing someone at the IdP stops their next SSO sign-in, but a device already signed in stays signed in. To cut someone off, remove them from the team.

Who an IdP email can reach

Until an account is linked to an IdP identity, the IdP’s email only matches an account that owns the team, is a member, or has an open invite. So invite people first, then have them sign in with SSO. The first sign-in links the account, and later ones follow that link even if the email changes at the IdP.