SSO restrictions
Two SonarQube Cloud settings let enterprise admins enforce SSO-only login, block DevOps platform tokens, and limit organization creation for managed users.
These features require a SonarQube Cloud Enterprise license.
The Additional configurations section of SSO & Provisioning offers two settings that let enterprise admins restrict what SSO-managed users can do:
Restrict DevOps platform access: forces users on verified domains to authenticate exclusively through SSO, blocking DevOps platform logins and personal access tokens (PAT) in social accounts.
Restrict org creation for managed users: limits organization creation to enterprise admins creating organizations within the enterprise.
Recovery account
Before enabling either setting, it's highly recommended that all enterprise admins configure a recovery account. If SSO becomes unavailable after enforcement is active, admins without a recovery account will be locked out of the enterprise.
See Recovery account for SSO for setup instructions.
Restrict DevOps platform access
When SSO is initially configured, users with a company email address can still authenticate through an independent social or DevOps platform account. Enable Restrict DevOps platform access to require SSO login and close this governance gap: any user whose email belongs to a verified domain must log in exclusively through SSO. This also restricts the usage of personal access tokens (PAT) in social accounts.
Prerequisites
Domain verification must be complete before you can enable this feature. Enforcement applies to all verified domains associated with your SSO connection.
Enable Restrict DevOps platform access
Retrieve your enterprise. See Retrieving and viewing your enterprise.
Go to Administration > SSO & Provisioning.
In Additional configurations, enable Restrict DevOps platform access.
Effect of enabling
When enabled, for all users whose email belongs to a verified domain:
DevOps platform logins are disabled.
Users must log in exclusively via SSO.
Personal access tokens created via DevOps platforms are blocked.
Users whose email belongs to an unverified domain are not affected.
Disable
Removing the last verified domain from your enterprise disables Restrict DevOps platform access. Users previously required to use SSO can then log in again through their DevOps platform account.
Restrict the creation of organizations
The Restrict org creation for managed users setting lets enterprise admins control which accounts can create SonarQube Cloud organizations. When enabled, organization creation is limited to enterprise admins creating organizations within the enterprise.
Prerequisites
To turn on this setting, you need:
Enterprise admin access.
SSO configured for your enterprise. See the Set up SSO page.
Your domain must be verified. See the Domain verification page.
Enable the setting
Retrieve your enterprise. See the Retrieving and viewing your enterprise page.
Go to Administration > SSO & Provisioning.
In Additional configurations, enable Restrict org creation for managed users.
When enabled:
SSO-managed enterprise admins are restricted to creating organizations that automatically join this enterprise.
All other domain users are blocked from creating organizations entirely.
Disable the setting
Follow the same steps and disable the feature.
Enterprise creation
SSO-managed users cannot create a new enterprise, regardless of whether this setting is enabled. If this setting is enabled, non-SSO users are also restricted when their email domain matches any enterprise that has verified their domain. To create an enterprise, use a non-SSO account and ensure the setting is off. See the Creating your enterprise page for details.
Related pages
Last updated
Was this helpful?