Single sign-on not enforced
AI summary
Use this security rule to check if your Claude organization has disabled single sign-on enforcement. Without enforcement, members can use passwords instead of your corporate identity provider, bypassing conditional access and MFA protections.
What it detects
Detects organizations where the sso_enforced setting is present but disabled.
Why it matters
Without enforced single sign-on, members can keep signing in with passwords outside the corporate identity provider - no conditional access, no MFAMultifactor authenticationMultifactor authentication asks a user for a second form of verification, such as a code on their phone or a fingerprint, in addition to the password.Read more policy, no automatic deprovisioning on offboarding. The effective settings endpoint reports sso_enforced per organization; a returned value of false means the control exists but is switched off. Organizations where the setting is not returned at all are not flagged (absent means not controllable on that plan, not off).
The rule
Every Claude Organization Setting where Display Name equals 'sso_enforced' and Value equals 'False'
In Rencore Governance
Details
| Applies to | Claude organization setting |
|---|---|
| Connector | Claude Enterprise |
| Severity | High |
| Category | Security |
| Recommended | Yes |
| Recommended automation | None |
| License type | Standard |
Frequently asked questions
What does the single sign-on not enforced policy detect?
The Single sign-on not enforced policy detects organizations where the sso_enforced setting is present but disabled.
Which objects does the single sign-on not enforced policy check?
The Single sign-on not enforced policy checks Claude organization setting objects from the Claude Enterprise inventory and reports each one that matches its rule as a violation.
How severe is a violation of the single sign-on not enforced policy?
Violations of the Single sign-on not enforced policy have High severity. The policy is in the Security category.
Which module includes the single sign-on not enforced policy?
The Single sign-on not enforced policy comes with the Claude Enterprise connector (in preview) in the AI & Agents module of Rencore Governance, an add-on module on the Premium and Enterprise Plans.
Was this page helpful?
Thanks for the feedback.
Thanks. What was wrong?