Should single sign-on be required, and how not to lock yourself out

A single sign-on connection is either **Optional** or **Required**, and the difference is worth understanding before you change it.

**Optional**

Your people can use your identity provider, and passwords keep working. This is the right setting while you are testing, and the right setting for an organization with contractors, seasonal staff, or anyone your directory does not carry.

**Required**

Turtini stops offering a password for that domain and sends people to your provider instead. Use this once every person on the domain is genuinely in your directory.

**Add your break-glass addresses first**

Before you turn Required on, put at least one address in **Break-glass addresses** -- typically a founder or the person who administers this. Those addresses keep their password even while the domain is enforced.

The reason is simple: the switch that routes everyone to your provider is administered from inside Turtini. If your provider has an outage, or the connection is misconfigured, the only person who can turn it back off must still be able to get in. Break-glass is that person.

Turtini never reveals which addresses are on the list -- the exemption is applied on our servers, so the sign-in page cannot be used to discover who is exempt.

**What Required does and does not do today**

Required is a routing decision: the sign-in box refuses to attempt a password for that domain. It is not yet a server-side refusal, so it should be read as "everyone goes through the provider" rather than "a password is impossible". The strongest guarantee available today comes from directory sync: people your directory creates in Turtini are created with no password at all, so there is nothing for them to sign in with except your provider.