Requiring SSO and two-factor authentication
Make single sign-on mandatory, keep up to two break-glass owners, and protect password sign-in with two-factor authentication.
Two-factor authentication for password sign-in
Anyone who signs in with a password can add two-factor authentication (an authenticator app code) on their Account page. We strongly recommend it for every password account, and it's required for break-glass owners.
Requiring SSO for everyone
Once single sign-on works and your domain is verified, you can make SSO the only way in:
- Go to the Security page.
- Optionally choose break-glass owners first (see below).
- Turn on Require SSO.
To stop you from locking yourself out, AssetTrove only lets you turn this on from a session that could get back in: one signed in through SSO, or a break-glass owner signed in with two-factor authentication.
Important When you require SSO, everyone else who is signed in with a password is signed out immediately.
Break-glass owners
If your identity provider ever goes down, you still need a way in. You can choose up to two owners who keep password sign-in while SSO is required.
- Each break-glass owner must have two-factor authentication set up.
- Every break-glass sign-in is recorded as a critical event in the audit log, and all owners are emailed, so the emergency route can't be used quietly.