Settings & your account — Require single sign-on for your team

If you own a workspace, Settings → Security offers Require single sign-on. Switch it on and everyone in the workspaces you own must sign in with Google or Microsoft: password sign-in is refused for them, and anyone already signed in with a password is asked to switch within a minute. It sits beside Require two-factor for your team and the two work together. The switch stays unavailable until it is safe to use: an identity provider must be configured, you must have connected one to your own account, and everyone on your team must have connected one too — the card names anyone who has not. This is stricter than the two-factor requirement on purpose. Somebody told to set up two-factor can always do it on the page they land on; somebody told to use single sign-on cannot, if their provider will not vouch for their address, so the switch waits for them rather than locking them out. You are exempt from your own switch, so a provider outage can never strand the one person who can turn it off.