# What does enforcing company sign-in mean?

Enforcement makes the company account the only way into the portal, but only for the addresses of your confirmed domains. Everything else stays untouched, and for an outage of the provider, at most two emergency accounts remain open.

> **Type:** concept
> **For:** Owners who are about to decide whether to enforce company sign-in, and everyone who wants to know what changes for them.
> **Prerequisite:** A provider that is set up, with at least one confirmed domain.
> **Where in the portal:** **Settings › Organization › Company sign-in › 3. Enforcement**

## What enforcement covers

Only the domain of the entered address matters. It decides which sign-in method applies. Everything that lies outside your confirmed domains stays untouched.

| Affected | Effect |
|---|---|
| Addresses in your confirmed domains | No password, no sign-in link, no password reset. Only company sign-in remains. |
| Addresses outside these domains | Untouched. They keep signing in as before. |
| Existing sessions | They continue and expire normally. Signing out immediately is a separate action, **Log out everywhere**, in session management. |

![The domain of the entered address decides whether only the company account applies or everything stays as before, with the emergency accounts as a fallback.](/docs/organization/bilder/2d310905-enforcement-effect.svg)

Anyone who tries a password anyway gets **This organization only allows sign-in through the company account.** The silent paths are trickier: Sign-in link and **Forgot your password?** still answer for covered addresses with the same neutral confirmation, but nothing is sent. Anyone waiting for it waits in vain. This feedback is intentional, because the portal never reveals whether an account exists.

One thing enforcement does not do for you: The company account replaces the password, not the second factor. If two-factor sign-in is set up for an account, it still applies after signing in through the provider.

## The emergency accounts

In the dialog **Enforce company sign-in?**, you choose **Break-glass accounts (at most 2)**. These emergency accounts may sign in with a password even when company sign-in is enforced, as the fallback for an outage of your provider. That is why resetting the password stays open for them as the only exception: A password they could never renew would be a trap. The sign-in link stays blocked for them as well.

Each emergency account needs a second factor that has been set up. Accounts without one appear in the list, visible but not selectable, with the note “— no second factor set up”. The server rejects them anyway. If emergency accounts are on file, the page permanently shows the note **Break-glass accounts are configured** with the time of the last use. Every use appears in the change log.

If nobody can get in despite that, platform operations can issue a one-time emergency access. It is never sent by email but handed to you directly. Whoever redeems it sets a new password and can then sign in with a password for 24 hours. After that, only sign-in through the company account applies again.

## What follows

- **Prepare emergency accounts before turning enforcement on.** First set up two-factor sign-in for the intended accounts, otherwise they are not selectable in the dialog.
- **External people stay outside the rule.** A consultant or a temp worker with an address outside your domains does not notice the enforcement. If you want to cover them too, these people need an address in a confirmed domain.
- **Turning it off is easy.** You can turn enforcement off again at any time and without proof. Only turning it on requires a fresh test sign-in.
- **Check the exception regularly.** The permanent note names the last use. If the fallback is no longer needed, remove the accounts from the selection.

## Related

- [Set up company sign-in (SSO)](/docs/organization/set-up-company-sign-in)
- [Set up two-factor sign-in](/docs/organization/set-up-two-factor)
- [Sign-in, password, and access](/docs/help/sign-in-troubleshooting)