SSO Lockout Recovery

SSO admins now have a self-service way back in if an SSO change locks their organization out. Once SSO is enforced, password login is disabled — so a misconfiguration like a wrong cert, an IdP switch, or a bad attribute mapping could previously lock an entire org out with no self-service path back in.

When enabling or editing SSO, an admin now generates single-use recovery codes (shown once, stored hashed) as a required step of saving the config. If the org is later locked out, a user with the Edit SSO permission redeems a code at the sign-in page, which triggers a password-reset link to their on-file email. Getting back in means proving you hold a valid code and control the mailbox — no Monte Carlo intervention required.

Editing a live SSO config also opens a grace window: password login stays available for that admin only, so a misconfiguration can't instantly lock everyone out. Additional guardrails include email verification as a second factor, rate-limiting on the redeem endpoint, and an optional per-account IP allowlist on that endpoint.

Learn more here: https://docs.getmontecarlo.com/docs/sso-recovery-codes