# Require single sign-on

> Make your staff sign in through your provider and nothing else, with recovery administrators for the day it is down.

When you require single sign-on, staff with an address on your approved domains sign in through your provider and nothing else. Their password and passkey stop working for Taktyl, and anybody already signed in that way is asked to sign in again on their next visit.

## Who it covers

It covers staff of your organisation whose email address is on one of your approved domains, and people on those domains who have no Taktyl organisation yet. It does not cover:

- staff here on another email domain, such as a contractor's own address: they keep their password;
- students, who keep opening activities from their course or the activity's link;
- your recovery administrators.

LMS launches, the Data API, AI assistants and SCIM are not affected.

## Recovery administrators

Choose one to three organisation admins who can still sign in with their password and their own second factor if your provider is unavailable. Each must have a second factor first: an authenticator app, email codes or a passkey. Every time one signs in that way, your other organisation admins are told.

If a recovery administrator loses their admin role, is suspended or removes their last second factor, they stop being one, and your admins are told when nobody is left.

## Switch it on safely

Under **Require single sign-on** on the **Single sign-on** screen, a short list says what is still needed:

1. Single sign-on is switched on.
2. At least one email domain is approved.
3. You signed in with your provider in this session, or passed a **Test sign-in** as yourself. This proves it works before anybody has to use it.
4. At least one recovery administrator is chosen.

Then press **Require single sign-on**. The confirmation says how many people will be asked to use your provider, and how many staff on other domains keep their passwords.

While it is required you cannot switch single sign-on off or change the protocol. Press **Stop requiring single sign-on** first: passwords and passkeys work again for everybody at once.

## What people see

- On the sign-in page, a covered person with the right password is told which sign-in system to use.
- **Forgotten it?** says the same thing for every address on your domains, so nobody can tell who is a recovery administrator.
- Somebody on a covered domain cannot make a new organisation by signing up: they ask you for an invitation.
- A covered person cannot change their email address on their profile.

## If you are locked out

If your provider is down and no recovery administrator can sign in, use **Contact support** on the sign-in page. We can stop requiring single sign-on for your organisation; we write down why, and your organisation admins are told.