We've set up Single Sign on with SAML. Our IdP is OneLogin and using their link, we are able to connect.

We now want to disable password login for some users in Salesforce. Salesforce's documentation points me towards a "Use Single Sign On" or "Is Single Sign On Enabled" permission (depending on the age of the document) on the user profile, however I cannot find this permission. Does anyone know where to find it?


I'm happy to say that this feature is now fully accessible to administrators. It has been possible to prevent users from using their Salesforce credentials when they were SSO-enabled but it required contacting Salesforce support.

As of Summer '20 (release notes), you can configure SSO in a way that it prevents users from using their internal credentials.

Single Sign-On Settings


You will find the "Is Single Sign-On Enabled" checkbox on the User profile under the System Permissions group. Please note that this permission is related to delegated authentication and not to SAML SSO.

  • 3
    Is also worth noting that this field is a bit of a misnomer. It should actually read something like "Force Single Sign-On" but the way it reads makes it sound like an option.
    – greenstork
    May 16 '14 at 19:22
  • Just curious, does this permission only show up in the User record after delegated authentication is enabled for the org?
    – John_Henry
    Jan 21 '16 at 16:17
  • 2
    Yes - it's not visible before delegated authentication is enabled by support.
    – haagen
    Jan 26 '16 at 13:34
  • I have an active SSO setup but don't see the "Is Single Sign On Enabled" box - has this been deprecated?
    – jaw999
    May 13 '16 at 19:52

To turn it off for a portion of users is fairly challenging. Delegated authentication on the other hand can be turned on/off on a profile or permission set basis. To turn off authentication via SFDC username/password for everyone and leave the identity provider as the only way in, do this in SFDC

  1. Turn on MyDomain
  2. My Domain > Login Page Branding: unselect Login Page. Your IdP (whatever you named it) should be the only one selected here. If your IdP doesn't show up on this list, you didn't define it correctly under Single Sign-On Settings
  3. My Domain > Login Policy. Check 'Prevent login from https://login.salesforce.com'
  • Hello @haagen, I was not able to locate that permission. Is this still there with so many updates been done later on into salesforce? Jan 19 '18 at 7:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.