Let your identity provider decide who gets into the workspace, using SAML 2.0.
Who this is for
The Owners of the account that holds the workspace, when the account is on the Enterprise plan. No workspace role can configure it, Admin included: identity configuration decides who may sign in at all, and an admin who could change it could grant themselves a way back in after being removed.
Before you start
You need access to your identity provider's admin console and control of your email domain's DNS.
Steps
The page describes the shape of this: "Configure it yourself: no support ticket, no engineering call. Verify your domain, test the connection, then enforce."
Open Single sign-on & SCIM for your workspace.
Enter your Email domain, for example
acme.com.Publish the TXT record shown, then select Verify domain.
Fill in the SAML fields from your identity provider and select Save configuration.
Select Test connection and complete a real sign-in.
Only once the test passes, turn enforcement on.
What happens next
With enforcement on, a member of your workspace entering their email address is sent to your identity provider instead of being asked for a password.
The Owners of the account that holds the workspace keep a password route, and everyone else at your domain, admins included, is sent to your identity provider. If the identity provider is unreachable, an Owner of the account can still sign in and turn enforcement off.
Single sign-on belongs to the workspace and the Enterprise plan to its account. If the workspace moves to another account, enforcement for your domain stops, and the new account's Owners verify the domain again.
If it doesn't work
Enforcement stays locked until the domain is verified and the connection has been tested, so an untested connection can never lock everyone out at once.
If the domain will not verify, check the TXT record has propagated. DNS changes are not instant.
If the test fails, compare the entity id, sign-in URL and certificate against your identity provider character for character.
Related
Set up SCIM provisioning
My single sign-on login fails
Roles and what each one can do