Description

Ensure the workspace requires members to sign in through SAML single sign-on (on Scale or Enterprise plans) or through their company Google account, so that members cannot access the workspace using passwords or personal accounts that the company does not control.

Rationale

When members can sign in with any method, some use weak passwords or personal accounts that are not covered by company security rules. Requiring SSO or company Google accounts makes the company's identity provider control access, including its MFA and offboarding rules, so disabling a user there also blocks their Render access.

Impact

  • Sign-in is controlled by the company identity provider

  • Personal and password logins are blocked

  • Members must sign in with the account that matches their invited email

Default Value

By default, members can use any supported login method (Google, GitHub, GitLab, Bitbucket, or email and password).

Pre-Requisites

  • Workspace Admin role

  • Company Google accounts for all members, or a Scale or Enterprise plan for SAML SSO

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.

  3. Check whether Google account login is enforced for the workspace.

  4. On Scale or Enterprise plans, also check whether SAML SSO is configured and enforced for your organization.

  5. If neither is enforced, follow the implementation steps.

Implementation Steps

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.

  3. Turn on the setting to enforce Google account login.

  4. Or, on Scale or Enterprise plans, configure SAML SSO for your organization and enforce it.

  5. Tell members to sign in with the Google account (or SSO account) that matches their invited email address.

  6. Note that API keys must be created while signed in with Google to access the workspace after this change.

Backout Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.

  3. Turn off the Google account login enforcement (or SSO enforcement).

Reference