2026-08-14

🔐 Require single sign-on

Enterprise SSO used to be an additional way in: you could offer it, but members with a password could always use that instead. Now you can make it the only way in.

Turn on Login policy → Require single sign-on on the Identity Providers page, and password and social sign-in are refused for everyone in your organization. Members who try anyway get a plain message telling them to use SSO — not a generic failure they have to guess at.

• Off unless you choose it. Nothing changes for your organization until an admin turns this on. Existing sign-in behaviour is exactly what it was.
• Not an immediate sign-out. People already signed in stay signed in until their next token refresh, then come back through SSO. Turning it on mid-afternoon doesn't eject your team.
• You can't switch it on before it can work. The toggle stays disabled until you have an active identity provider with a verified domain — so you can't remove every other way in before the replacement is proven.
• You can't delete your way into a lockout. With SSO required, deleting your last working identity provider is refused, not merely warned about.
• And if the worst happens anyway, DevStride support can restore access.

📚 Requiring single sign-on · Enterprise SSO setup

🛠 Fixes

• Custom fields no longer come back empty through the MCP. Fields whose schema allows a bare type alongside other options — a common shape for optional custom fields — could merge incorrectly and return null instead of the value you set. Reading and writing those fields through the MCP now round-trips correctly.