Skip to content

Require a specific sign-in method for one user

Restrict one member to your tenant's identity provider, so that their password and passkeys no longer enter your tenant, or give them back the ways your tenant admits. Other members are not affected.

Who can do it

A tenant administrator or a tenant access administrator, or a platform super administrator working inside your tenant. The console offers the change only to a person who holds the permission to manage your tenant's authentication policy.

You can only change it for someone whose permissions in your tenant you cover, and you must have confirmed your identity recently. On a SaaS deployment, a platform operator working inside your tenant under a support-access session cannot change it.

Before you start

  • The member must be linked to an active OIDC or SAML identity provider of your tenant. A link to an LDAP directory does not count: a directory verifies a password, which is a local way in.
  • Your tenant must admit sign-in through its identity provider: a tenant that admits only local sign-in refuses the restriction.
  • A member designated as break-glass cannot be restricted to the identity provider.

Steps

  1. Open Users in the sidebar.
  2. On the person's row, select the eye icon (View).
  3. On the Overview tab, under Membership in this tenant, read Signs in: As the tenant admits or Through the identity provider only.
  4. Select Restrict to the identity provider, or Sign in as the tenant admits to undo it.
  5. If the console asks you to confirm your identity, sign in again in the dialog it opens.

What you see when it worked

The console says How this member signs in was changed, and Signs in shows the new value.

While the member is restricted, a sign-in they prove locally is offered the identity provider instead. The member's next sign-in, refresh and tenant switch follow the new rule; a session already open is not ended. Every change is written to your audit log.

If it fails

The console shows How this member signs in was not changed, with the reason:

Reason Cause What to do
The restriction would leave the member no way in (authentication-posture-not-admissible) Your tenant admits local sign-in only, or the member holds no link to an active OIDC or SAML provider of your tenant Link the member to your identity provider first, or change your tenant's sign-in requirements
A refusal naming the permissions you lack (scope-subset-violation) The member holds permissions in your tenant that you do not Ask an administrator who holds those permissions
A conflict Another change to the membership was saved first Open the member again and retry
A request to confirm your identity (reauthentication-required) Your last sign-in is too old for this change Sign in again when asked, then retry

Without the console

Surface How
API PUT /api/v3/admin/tenants/{tenantId}/users/{userId}/authentication-path (operation replaceTenantUserAuthenticationPath) with authenticationPath FEDERATED_ONLY or POSTURE_DEFAULT

The key management CLI and the admin SDK have no command or method for this task.