SSO-exempt users
Once SSO is enabled, every member of your tenant signs in through your IdP. If your IdP is down or misconfigured, that means nobody can sign in, including the administrators who would fix it.
SSO-exempt users are your emergency access: a small number of members who can still sign in with their email and password while everyone else uses SSO.
Manage them under Settings → Account → Identity → SSO, in the SSO-exempt users section.
You can exempt users before SSO is turned on. Do it first, so a mistake in your IdP setup can't lock every administrator out on the day you go live.
Who can be exempt
- Any member of your tenant, whatever their role, including users provisioned by SCIM. Administrators can exempt themselves.
- Only tenant administrators can add or remove an exemption.
- Every time a user is added to or removed from the list, including the automatic removals below, an email goes to all of your tenant's administrators.
Keep the list short: an exempt user bypasses the controls your IdP enforces, such as conditional access and off-boarding.
Emergency access should not depend on the IdP it stands in for. If SCIM provisions an exempt user, your IdP can still deactivate them, which removes the exemption, or change their roles. The portal marks SCIM-provisioned users in the list. To take a user out of SCIM, use Remove provisioning under Settings → Account → Users, and leave them unassigned from the Agility app in your IdP.
When an exemption is removed automatically
| What happens | Result |
|---|---|
| Your IdP creates or updates the user over SCIM, including their roles | The exemption stays |
| The user is deactivated or deleted over SCIM, or removed from the tenant | The exemption is removed; a user added back later starts without one |
When an administrator removes an exemption while SSO is enabled, the user's open password sessions in the tenant end, and their SSO sessions carry on. When the user is removed from the tenant, all of their sessions there end.