# Members and “SSO only” mode

> Accounts created on first sign-in, the default role, linking existing accounts, no password sign-in for members, and the owner’s fallback sign-in.

## The account on first sign-in

The **“Create an account on first sign-in”** checkbox (on by default) is JIT provisioning: an employee whom the provider has confirmed but who does not exist in Buff yet gets an account at the moment of signing in. The login is formed from the part of the email before `@` (a number is added on a clash), and no password is set — sign-in is through SSO only. The account immediately becomes a member of the organisation with the role from the **“New member’s role”** field — Contributor or Maintainer, as a grant on the whole organisation (see [Roles](/en/docs/teams/roles)). The owner then fine-tunes a particular member’s permissions in the “Members” section as usual.

If the checkbox is off, only those whose account already exists and is linked (or gets linked by email/password — see below) can sign in through SSO; an unknown employee sees “account not found, and automatic member creation is turned off”.

To create an account, the provider must pass the **email** — otherwise sign-in ends with the error “the IdP did not pass an email”.

## Existing accounts

The link key is the employee’s stable identifier at the provider (`sub` in OIDC, `NameID` in SAML). On first sign-in Buff looks for the account like this:

1. **Already linked** — sign-in straight away.
2. **There is an account with this email on a verified domain** — linked automatically, sign-in straight away.
3. **There is an account with this email on an unverified domain** — Buff asks once for that account’s password, then links it.
4. **No account** — one is created (if enabled) or sign-in is refused.

A linked account that is not a member of the organisation is added to it with the default role. A change of email at the provider does not affect the link — it rests on the identifier.

## “Single sign-on only” mode

The **“Single sign-on only”** checkbox closes password sign-in for the organisation’s members: a password sign-in attempt is refused with a hint to press “Sign in with company SSO”, and password recovery for such accounts sends no email. Members’ existing password sessions end at the next refresh — within 15 minutes. Sessions opened through SSO keep working.

_Illustration: “Single sign-on only” mode is on — a warning reminds you that owners can still sign in with a password._

_Illustration: What a member sees after trying to sign in with a password._

**Owners are the exception.** An organisation owner can always sign in with a password. This is the fallback: if the provider is unavailable or its settings broke, the owner signs in, fixes the connection or turns the mode off — and nobody is locked out for good. That is why an organisation with the mode turned on must have at least one owner with a password and access to their email.

If an employee belongs to several organisations and at least one of them requires SSO, the password is not available to them — the session is opened through that organisation’s SSO and is valid in all of them.

## What is recorded in the audit log

Every action is visible in the organisation’s [audit log](/en/docs/audit-log): setting up and turning off the connection (`sso.config_set`, `sso.config_delete`), domains (`sso.domain_*`), the start of sign-in (`session.sso_start`), the sign-in itself marked “account created automatically” or “linked” (`session.sso_login`), linking by password (`session.sso_link`) and refusals — including sign-ins rejected by the provider, with the reason, and attempts to sign in with a password while “SSO only” mode is on.

## Not in the current version

SCIM provisioning (the provider creating and disabling accounts in advance, without a sign-in), mapping provider groups to permissions, and sign-in initiated from the provider’s side (IdP-initiated SAML). A departed employee loses access as soon as the provider stops confirming them: they cannot open new sessions, and the current one ends when it expires. To cut it off immediately, remove the member from the organisation.