Description

Ensure the Require Team Members to login with SAML setting is enabled, so that no team member can access the team's projects, deployments, or settings unless they are signed in through SAML SSO. Configuring SSO alone is not enough if members can still use other login methods.

Rationale

If SAML SSO is configured but not enforced, members can keep using personal Git or email logins that bypass the company's MFA and access rules. A former employee or an attacker with a stolen personal login could still reach the team. Enforcing SAML makes sure every session comes through the identity provider.

Impact

  • All members must sign in through SAML SSO

  • Blocks access through personal logins

  • Members need an active IdP account to sign in

Default Value

By default, SAML enforcement is disabled, even when SAML SSO is configured. Changing the SAML configuration later turns enforcement off automatically.

Pre-Requisites

  • Team Owner role

  • SAML SSO already configured

  • The Owner must be signed in through SAML SSO

Test Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Open Settings in the sidebar and select Security & Privacy.

  4. In the Authentication and User Provisioning section, verify that Require Team Members to login with SAML is Enabled.

  5. If it is disabled, follow the implementation steps.

Implementation Steps

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Sign in using SAML SSO to confirm the configuration works.

  4. Open Settings in the sidebar and select Security & Privacy.

  5. Toggle Require Team Members to login with SAML to Enabled.

  6. Tell team members they must sign in with SAML SSO from now on.

Backout Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Open Settings in the sidebar and select Security & Privacy.

  4. Toggle Require Team Members to login with SAML to Disabled.

Reference