{"meta":{"title":"Locking down single sign-on in your enterprise","intro":"Take action in a security incident by blocking SSO for all users except enterprise owners.","product":"Enterprise administrators","breadcrumbs":[{"href":"/en/enterprise-cloud@latest/admin","title":"Enterprise administrators"},{"href":"/en/enterprise-cloud@latest/admin/managing-iam","title":"Identity and access management"},{"href":"/en/enterprise-cloud@latest/admin/managing-iam/respond-to-incidents","title":"Respond to incidents"},{"href":"/en/enterprise-cloud@latest/admin/managing-iam/respond-to-incidents/lock-down-sso","title":"Lock down SSO"}],"documentType":"article"},"body":"# Locking down single sign-on in your enterprise\n\nTake action in a security incident by blocking SSO for all users except enterprise owners.\n\nWhen your enterprise is affected by a major security incident, you can temporarily block single sign-on for all users except enterprise owners. This allows you to lock down access to your enterprise in order to investigate the incident within a more isolated surface area.\n\nThe outcome of this action depends on your enterprise type:\n\n* **Enterprise Managed Users**: Prevents users from signing in to their managed user account entirely.\n* **Enterprise with personal accounts**: Prevents users from authenticating to access SSO-protected resources or authorize tokens for SSO, but does not prevent them from signing in to their account and accessing non-protected resources.\n\nIn either case, all existing active SSO sessions are terminated, including for enterprise owners, who can reauthenticate with SSO to access the enterprise during the lockdown.\n\n## Locking down single sign-on\n\n1. Navigate to your enterprise. For example, from the [Enterprises](https://github.com/settings/enterprises?ref_product=ghec&ref_type=engagement&ref_style=text) page on GitHub.com.\n1. At the top of the page, click **Settings**.\n1. Find the correct page for your enterprise type:\n * **Enterprise Managed Users**: At the top of the page, click **Identity provider**.\n * **Personal accounts**: Click **Settings** at the top of the page, then click **Authentication security** in the left sidebar.\n1. Scroll down to the \"Danger zone\" section and, next to \"Single sign-on lockdown\", click **Enable**.\n\n >[!IMPORTANT] If you have the \"Manage enterprise single sign-on configuration\" permission but are **not** an enterprise owner, you can enable the lockdown, but you will be unable to authenticate with SSO while the lockdown is active. If your enterprise uses Enterprise Managed Users or has enabled SAML at the enterprise level, this means you will not be able to authenticate to disable the lockdown later.\n\n1. If you are an enterprise owner, reauthenticate with SSO.\n1. Once the investigation is complete and you are confident in resuming SSO authentication, come back to this section and disable the lockdown."}