KB: Verifying SSO Enforcement and Disabling Password Login

Solution Details

Identify Users That May Bypass SSO

SSO is configured, but some users may appear able to sign in using their existing password credentials. This can occur particularly with users who created standalone AltiumLive accounts before SSO and SCIM provisioning were configured. Verify that affected users are associated with the Company Account and that the applicable authentication settings do not allow password authentication.

Understand SSO and Provisioning Differences

Users who previously created standalone AltiumLive accounts may encounter account conflicts during provisioning. These conflicts can prevent affected accounts from being provisioned as expected and must be resolved before using provisioning status as part of the verification process.

SSO and SCIM perform related but distinct functions. SSO provides sign-in authentication, while SCIM automates user and group provisioning between the company and its Identity Provider. Successful SCIM provisioning confirms synchronization, but does not by itself confirm that password authentication is disabled. Company-level and applicable user-level authentication settings must be verified separately.

Verify Provisioning and Authentication Settings

• Confirm that affected users appear under Users » Users & Groups in the Company Dashboard.
• Resolve provisioning conflicts involving pre-existing AltiumLive accounts.
• Review Microsoft Entra provisioning and sign-in logs for affected users.
• Treat successful SCIM provisioning as confirmation of synchronization, not as confirmation of SSO-only enforcement.
• Verify the company-level authentication configuration.
• Check affected users for user-specific authentication method overrides.
• Verify that password authentication is not allowed by the authentication settings applicable to the user.
• Test authentication in a new private or incognito browser session.

Verify SSO Enforcement Step by Step

1. Check if users appear under the Company Dashboard

   • Open the Company Dashboard and select Users » Users & Groups.
   • Ensure each affected user appears in the Company Account user list.
   • If a user has a pre-existing AltiumLive account, check for an account conflict that could interfere with provisioning.
   • Refer to: KB: Azure SSO User Provisioning Fails with 400 Error Due to Existing Account Conflict in AltiumLive

2. Verify Microsoft Entra logs

   • In Microsoft Entra ID, open Enterprise Applications » SSO App » Provisioning and review the provisioning activity for the affected user.
   • Review the corresponding Sign-In Logs and check for errors associated with the affected user.
   • Check for failed, pending, or skipped provisioning operations.
   • If provisioning completes successfully, consider the user successfully synchronized. Do not use successful provisioning alone as confirmation that SSO-only authentication is enforced.

3. Ask users to clear browser cache

   • An existing browser session or cached authentication state may affect authentication testing.
   • Ask the affected user to clear the browser cache or perform the verification from a new private or incognito browser session.
   • Use this step only to establish a clean authentication test. Clearing the browser cache does not configure or enforce SSO.

4. Check authentication methods in the Dashboard

   • Open the Company Dashboard authentication configuration at https://account.altium.com/authentication and review the company-level authentication methods.
   • Verify that SSO is enabled and that password authentication is not enabled as an alternative authentication method.
   • Open https://account.altium.com/users-and-groups and select the affected user's profile.
   • Select Edit under Authentication methods and check whether Override authentication methods is enabled.
   • If an unwanted user-specific override is enabled, clear Override authentication methods and save the profile.
   • Refresh the page, reopen Authentication methods, and save again so that the applicable company-level configuration is reflected for the user.
   • Test the affected account from a new private or incognito browser session and verify that password authentication is not available and the user is routed through SSO.
   • Reference: Authentication Methods | Company Dashboard Documentation

SSO-only authentication is verified when the user is correctly associated with the Company Account, provisioning has no relevant failures, the authentication settings applicable to the user do not allow password authentication, and a new private-browser sign-in routes the user through SSO.

Additional Notes

Best Practices for SSO Management

• Review authentication logs regularly to verify that password-based logins are not occurring.
• Monitor SCIM provisioning cycles to confirm successful synchronization.
• Remove or merge unused standalone AltiumLive accounts to prevent provisioning conflicts.
• Communicate SSO enforcement changes clearly to end users.
• Ensure domain verification remains valid to avoid SSO disruptions.

Deployment Verification Tips

• After enabling SSO-only authentication, perform the authentication test in a private or incognito browser session.
• Compare assigned users in Microsoft Entra with users in the Company Dashboard.
• Check company-level and applicable user-level authentication settings independently of SCIM provisioning status.
• Check provisioning logs for failed, pending, or skipped users.
• Confirm that password authentication is unavailable and that the affected user is routed through SSO.

References

• Authentication Methods | Company Dashboard Documentation
• Managing Users | Company Dashboard Documentation
• KB: Enabling a Specific Authentication Method for a Particular User
• KB: Azure SSO User Provisioning Fails with 400 Error Due to Existing Account Conflict in AltiumLive