# Ensure login is restricted to SSO or company Google accounts

- Source: https://support.icompaas.com/support/solutions/articles/a_1793876661781748-ensure-login-is-restricted-to-sso-or-company-google-accounts
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Render Cloud](https://support.icompaas.com/support/solutions/c_1793875953948152) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1793875960840493)
- Last updated: 2026-11-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the workspace requires members to sign in through SAML single sign-on (on Scale or Enterprise plans) or through their company Google account, so that members cannot access the workspace using passwords or personal accounts that the company does not control.

**Rationale**

When members can sign in with any method, some use weak passwords or personal accounts that are not covered by company security rules. Requiring SSO or company Google accounts makes the company's identity provider control access, including its MFA and offboarding rules, so disabling a user there also blocks their Render access.

**Impact**

-   Sign-in is controlled by the company identity provider
    
-   Personal and password logins are blocked
    
-   Members must sign in with the account that matches their invited email
    

**Default Value**

By default, members can use any supported login method (Google, GitHub, GitLab, Bitbucket, or email and password).

**Pre-Requisites**

-   Workspace Admin role
    
-   Company Google accounts for all members, or a Scale or Enterprise plan for SAML SSO
    

**Remediation**

**Test Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.
    
3.  Check whether Google account login is enforced for the workspace.
    
4.  On Scale or Enterprise plans, also check whether SAML SSO is configured and enforced for your organization.
    
5.  If neither is enforced, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.
    
3.  Turn on the setting to enforce Google account login.
    
4.  Or, on Scale or Enterprise plans, configure SAML SSO for your organization and enforce it.
    
5.  Tell members to sign in with the Google account (or SSO account) that matches their invited email address.
    
6.  Note that API keys must be created while signed in with Google to access the workspace after this change.
    

**Backout Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.
    
3.  Turn off the Google account login enforcement (or SSO enforcement).
    

**Reference**

-   [https://render.com/docs/login-settings](https://render.com/docs/login-settings)
    
-   [https://render.com/docs/saml-sso](https://render.com/docs/saml-sso)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.