Require SSO
Require members to sign in through Microsoft Entra ID: prerequisites, the owner break-glass, effect on existing sessions, and Botyard two-factor after SSO.
The Sign-in policy card on User menu › Settings › General › Single sign-on has two settings: Require SSO and Also ask for Botyard two-factor after SSO. Only organization owners can change them.
Require SSO
With Require SSO on, members must sign in through your identity provider to use this organization. A session started another way, with a Botyard password, magic link, passkey or Google, can't reach the organization. It works only in the policy's own organization: the same person can still use other Botyard organizations they belong to.
Before you can turn it on
The switch stays disabled until every prerequisite holds. Under Before you can require SSO, the card lists any that don't:
| Prerequisite | What the card says |
|---|---|
| An active identity provider connection | Connect an identity provider and make sure it's enabled. |
| You signed in through it, in your current session | Sign out and sign back in through your identity provider, so we know it works for you. |
| Require MFA is off | Turn off “Require MFA” — your identity provider enforces MFA for SSO sign-ins. |
Require MFA is under User menu › Settings › General › Security. Configure MFA in Entra, for example with Conditional Access, instead.
Turning it on
Turn on Require SSO and confirm Require SSO for everyone?.
- Nobody is signed out. From their next request, members who didn't sign in through your identity provider lose access to the organization until they do.
- Sessions that did come through your identity provider keep working.
Owner break-glass
Owners who signed in with Botyard MFA keep access while SSO is required. That way an owner can still get in, and turn Require SSO off, if your identity provider is unavailable or misconfigured. Each break-glass access is recorded in the audit log.
Make sure at least one owner has a Botyard authenticator set up before you require SSO.
While SSO is required
You can't disable or disconnect the identity provider connection, because that would lock members out. Turn off Require SSO first.
Also ask for Botyard two-factor after SSO
By default, your identity provider owns MFA: an SSO sign-in is not asked for a Botyard two-factor code.
When you turn on Also ask for Botyard two-factor after SSO, members who have set up a Botyard authenticator are asked for their code after signing in through your identity provider. Members without one are not asked, and that includes everyone created through SSO or SCIM provisioning. To require MFA for everyone, enforce it in Entra.
Provisioning with SCIM
Let Microsoft Entra ID create, update and remove Botyard members over SCIM 2.0: token, Tenant URL, the required externalId mapping, group-to-role mapping and health.
SSO troubleshooting
What Botyard's SSO sign-in error codes mean and how to fix them, plus SAML security-policy rejections, single logout caveats and SSO settings errors.