# Ensure SSO/SAML is enforced for organization login

- Source: https://support.icompaas.com/support/solutions/articles/a_1790103899528211-ensure-ssosaml-is-enforced-for-organization-login
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Supabase cloud](https://support.icompaas.com/support/solutions/c_1790103054038308) › [supabase checks](https://support.icompaas.com/support/solutions/folders/f_1790103067540538)
- Last updated: 2026-09-22
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure SAML single sign-on (SSO) is configured for the Supabase organization with the company's identity provider, and that members join and sign in using their SSO accounts. Only one non-SSO Owner account should remain, kept as a break-glass account for emergency access.

**Rationale**

Without SSO, each member signs in with a separate password or GitHub login that the company does not control, and offboarding depends on removing people manually. With SSO, the identity provider controls access, applies company MFA rules, and removes access as soon as a user is disabled. This greatly reduces the risk of former staff keeping access to production projects.

**Impact**

-   Sign-in to the organization is controlled by the identity provider
    
-   Disabled IdP users can no longer sign in
    
-   Existing non-SSO members must be re-invited with SSO accounts
    

**Default Value**

By default, SSO is not configured. SAML SSO is available on the Team and Enterprise plans.

**Pre-Requisites**

-   Organization Owner role
    
-   Team or Enterprise plan
    
-   Admin access to the identity provider
    
-   One non-SSO Owner account kept for emergency access
    

**Test Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your organization.
    
3.  Open Organization Settings and select SSO.
    
4.  Verify that an SSO provider is configured and enabled.
    
5.  Open Organization Settings and select Team, and verify that all members except the break-glass Owner use SSO accounts.
    
6.  If SSO is not configured or non-SSO members remain, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your organization.
    
3.  Open Organization Settings and select SSO.
    
4.  Configure your identity provider using the provider-specific guide, and keep auto-join disabled at first.
    
5.  Test signing in with your own SSO account.
    
6.  Invite members with SSO-required invitations, then remove their old non-SSO accounts from the Team page.
    
7.  Keep one non-SSO Owner account for emergency access.
    

**Backout Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your organization.
    
3.  Confirm that a non-SSO Owner account can sign in.
    
4.  Open Organization Settings and select SSO.
    
5.  Disable the SSO provider. Note that SSO users will immediately be unable to sign in.
    

**Reference**

-   [https://supabase.com/docs/guides/platform/sso](https://supabase.com/docs/guides/platform/sso)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.