# SSO bypass — retained record

> Retained news record from news:ml-clerk-changelog.

Canonical: https://highsignal.app/data/records/24f843c33d39cffb

[← sources](https://highsignal.app/data)


source: [news](https://highsignal.app/data/news) (news:ml-clerk-changelog)  published 2026-09-29 00:00 ingested 2026-10-24 10:04

[original source ↗](https://clerk.com/changelog/2026-09-29-sso-bypass)

## retained text



```
SSO bypass
- Category
- SSO
- Published
Let specific users sign in with an email code when their enterprise SSO connection is unavailable.
An active enterprise single sign-on (SSO) connection requires users on its domains to sign in through an identity provider (IdP). If the IdP goes down or the connection breaks because a certificate expires or a setting changes, those users can't sign in, including the people who need to fix the connection.
SSO bypass lets users on an allowlist sign in with a one-time email code instead of using the IdP. Everyone else must continue to use SSO.
How it works
Add users to a connection's allowlist. When one of them enters their email address, <SignIn /> shows a Can't use SSO? link next to the SSO option. After confirming they want to continue without SSO, they get a code by email and sign in with an ordinary session. Users who aren't on the allowlist don't see the link.
You can only add users with a verified email address on a domain the connection serves. Clerk doesn't check whether the address still exists in your IdP. Clerk records each successful bypass as a sign_in.sso_bypass.succeeded event in Application Logs.
Who manages the allowlist
- You can manage the allowlist from the connection's page in the Clerk Dashboard or with the Backend API. Both options work whether or not your application uses Organizations.
- Organization members with the org:sys_entconns_sso_bypass:manage system permission can manage their Organization's allowlist from the Security tab of <OrganizationProfile />. The default Admin role includes this permission. They can add one member or all members with a given role.
Get started
SSO bypass is available on every instance with enterprise connections. To use it, enable Email verification code sign-in and add users to an allowlist. Read the SSO bypass guide to learn more, including how to support it in a custom sign-in flow.
```



document fetched 2026-10-24 10:04