Enforce SSO

Learn how to disable Retool's standard authentication and require SSO authentication.

Retool 4.0.15 Stable

Enterprise

You can disable Retool's built-in authentication method (email address and password) and require that all users log in using SSO credentials.

Cloud instances

Verify your SSO configuration is correct

Cloud-hosted instances must configure and test SSO before enabling this setting. Disabling Retool's standard authentication can lock all users out of your organization.

Navigate to your organization's Single Sign On (SSO) settings and toggle Disable Login with Email and Password.

Disable standard authentication and enforce SSO.

Self-hosted instances

Set the DISABLE_USER_PASS_LOGIN environment variable, then apply the change:

Terraform blueprints

Set it in retool_helm_extra_values in main.tf, then run terraform apply.

Helm

Set it in your values.yaml, then run helm upgrade.

Docker Compose

Set it in docker.env, then run sudo docker compose up -d.