> For AI agents: the complete Sanity documentation index is available at [https://www.sanity.io/docs/llms.txt](https://www.sanity.io/docs/llms.txt).

# Prevent non-SAML users from joining your organization

This article describes how to prevent non-SAML users from joining your organization and what to do with existing users on non-SAML identity providers.

Organization administrators can turn on **Prevent non-SAML users** in the **SAML SSO** settings of the organization in Sanity Manage. This setting is available on plans that include SAML.

## Prerequisites

- SAML SSO configured and enabled for your organization. To set it up, see [Setting up single sign-on with SAML](https://www.sanity.io/docs/developer-guides/sso-saml).
- The Administrator role on the organization.

## Turn on Prevent non-SAML users

![Sanity.io SAML SSO settings page, showing SAML SSO is enabled, options for login, and reviewing non-SAML access.](https://cdn.sanity.io/images/3do82whm/next/5b580e38aa2918572601164b1b51e1c1d0a903a3-1826x1126.jpg)

The setting stops new non-SAML users. It does not remove the non-SAML users that are already members. To enforce SAML for all members, you must also remove the existing non-SAML users. 

## Before you remove existing non-SAML users

Before you remove users, know these facts:

- Sanity keeps each sign-in provider as a separate identity. A member who signed in with Google and with SAML has two accounts, and each account can have different roles. Sanity does not merge these accounts.
- The setting applies to all projects in the organization. Projects that are not on an Enterprise plan do not have SAML role mapping. You must give roles to members of these projects manually.
- If **Auto update roles on login** is on, Sanity sets the roles of a member from role mapping at each sign-in. Roles that you give manually to a SAML identity are removed at the next sign-in. Update your identity provider groups and your project role mapping instead.
- Work done by a non-SAML identity stays with that identity. Document history shows the old account. API tokens do not move to the SAML identity. Canvas documents that the old account owns are not available unless the owner shares them with the SAML identity first.

## Remove existing non-SAML users

We recommend these steps:

1. Turn on **Prevent non-SAML users**. This stops the list of non-SAML users from getting larger.
2. Compare the roles of each non-SAML identity with the roles of the matching SAML identity. Your Sanity account team can help you prepare this comparison.
3. Update your identity provider groups and your project role mapping, so that each SAML identity gets the roles it needs.
4. In the **SAML SSO** settings, select **Review** next to the count of non-SAML users. Manage opens the organization members in a new tab, filtered to non-SAML providers.
5. For each user, select **Remove from organization**.

> [!WARNING]
> SAML lockout
> After you remove all non-SAML users, a SAML configuration error can lock all members out of the organization. If this occurs, contact Sanity support.

## Next steps

- To set up or change your SAML SSO configuration and role mapping, see [Setting up single sign-on with SAML](https://www.sanity.io/docs/developer-guides/sso-saml).
- To learn how roles and SSO role mapping work for project members, see [Roles](https://www.sanity.io/docs/user-guides/roles).



## Related changelog entries

Entries are listed newest first; each link points to the full entry as markdown. Follow one when you need to know what changed, when, or why — for example, to summarize recent updates, explain behavior that differs from older documentation, or check whether a fix has shipped.

- [Manage v2026-09-03: Prevent non-SAML users from joining your organization](https://www.sanity.io/docs/changelog/9acad526-2b71-46f7-b274-bd21a0a4d64a.md) — September 25, 2026