← All keys & policies
Policy·organization
Organization SAML SSO enforcement
Tier 0 · CriticalControl
Why Tier 0
Decides whether the identity provider is the gate for the organization. Switching it off is a change to identity.
Enables, disables or reconfigures SAML single sign-on enforcement for the organization.
Available on: Enterprise Cloud. Source
Attack path
Disabling SSO enforcement removes the organization's central identity control point, letting compromised or stale credentials authenticate without the IdP's own MFA and conditional access policies.
Mitigations
- Alert on any change to SSO configuration
Detect
Alert on org.disable_saml, org.update_saml_provider_settings, org.enable_saml in the audit log.