I have a question about SSO in my Enterprise org. In sandbox we set up a permission set with the ;Is SSO Enabled' permission, and assigned members to that permset to test. As I understood this, only members placed in this permission set will be able to login exclusively via SSO. Users not in the permission set could still access via Salesforce Login.
But when I rolled out to production, in order to get access to the 'Is SSO Enabled 'permission, I was required to check the 'Disable login with Salesforce credentials' checkbox on the Single Sign On settings page. Shortly after, I started receiving notifications that folks were not able to log in via Salesforce login.
I want to be able to roll out Single Sign On to a select group of users first. How can I set this up? How can I get access to the 'Is Single Sign On enabled' permission without checking the 'Disable login with Salesforce Credentials' checkbox?
Thanks for quick replies-
Hi @Wayne Cordrey, to echo @Justin Porter's comments, I think you might have mixed 2 different things: (a) logging in from login.salesforce.com vs. logging in from the My Domain-specific page. and (b) single sign-on. You can definitely configure Salesforce such that all users CAN use SSO but some users MUST use SSO. Typically, you'd want everyone to SSO, force most of your users to SSO and let your admins choose (in case your SSO IdP fell apart for instance). As of Summer '20, you can prevent users from using their 'internal' Salesforce credentials. To do so, you'd enable 'Disable login with Salesforce credentials' (part of Single Sign-On Settings) and then you'd assign the Is Single Sign-On Enabled permission to a profile or permission set. Note that the permission is only visible if you check Disable login with Salesforce credentials first.
