> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/system-management/settings/single-sign-on-sso/enforce-sso-login.md).
# Enforce SSO login
To ensure company security and compliance requirements, you can enforce single sign-on (SSO) login for all DoControl users in your organization.
Enforcing SSO login provides your organization with:
* **Robust security** - With SSO, there is no need for user names, passwords, or password rotation. Centralized authentication through a single identity provider (IdP) reduces the attack surface compared to multiple separate logins.
* **Better access control and governance** - Admin users can enforce policies, session timeouts, and conditional access rules consistently.
* **Improved compliance** - SSO simplifies tracking who accessed what and when, facilitating compliance with standards such as ISO 27001, SOC 2, and GDPR.
{% hint style="warning" %}
You can enforce SSO login only for a single provider connection. Once SSO login is enforced for a specific SSO provider connection:
* Users can no longer login with another provider or use their existing credentials.
* Other connections that were previously enforced are turned off.
{% endhint %}
## Test your connection
You need to test that the SSO connection you define actually works in DoControl. Once the connection works, you can [enforce users](#enforce-login-with-sso) to always login with your selected SSO.
1. Logout from DoControl.
2. In DoControl, click **Login with SSO.**
3. Enter your email, and click **Login**.
4. Select your SSO provider.
## Enforce login with SSO
After you [test](#test-your-connection) that the SSO connection you defined actually works in DoControl, you can enforce it to meet identity governance and administration requirements.
Once enforced, users are obligated to login to DoControl with the selected SSO.
**To turn SSO enforcement on:**
1. From the top-right corner in any screen, go to **Settings > Admin > SSO.**
2. Select the relevant SSO provider.
3. Select the relevant connection.
4. Next to the SSO name, toggle **Enforce**.
Enforce login for Google single sign-on
{% hint style="success" %}
Users can now leverage single sign-on credentials when logging into DoControl.
{% endhint %}
## **Disable SSO enforcement**
If your organization needs to turn SSO enforcement off, for example, if you migrate to another SSO provider or connection, follow these steps:
1. From the top-right corner in any screen, go to **Settings > Admin > SSO.**
2. Select the relevant SSO provider.
3. Select the relevant connection.
4. Toggle **off** the **Enforce** button next to the SSO connection.
5. Follow the [steps](#revert-to-docontrol-user-login) to revert to DoControl login with existing user name and password.
## **Revert to DoControl user login**
If SSO enforcement was turned off, DoControl users can still login to the platform using existing connections (for example, Google or Okta). If you want to allow login with user name and password, you need to re-invite DoControl users to the platform.
1. From the top-right corner in any screen, go to **Settings > Team**.
2. Select the relevant team member and click the **Ellipsis** button next to their name.
3. Select **Resend invitation**.\
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.docontrol.io/docontrol-user-guide/system-management/settings/single-sign-on-sso/enforce-sso-login.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
