I've enabled SSO in docker compose file, I've also enabled SSO_ONLY: true
Now when I try to login to any account via web browser plugin OR bitwarden desktop app OR android bitwarden app I'm getting error like SSO sign-in required - when typing login - it doesn't redirect me to the O365 login page.
When I disable SSO_ONLY: true - it'll work without any problem, but there's another "issue". When you block some account on the EntraID - then user IS STILL ABLE to login via his master password.
Vaultwarden Build Version
1.35.2
Deployment method
Official Container Image
Custom deployment method
No response
Reverse Proxy
nginx 1.22.1
Host/Server Operating System
Linux
Operating System Version
Debian
Clients
Browser Extension
Client Version
No response
Steps To Reproduce
Set SSO_ONLY: true in docker compose
Deploy docker container
Try to login via browser extension / desktop app / android app.
Expected Result
To be able to login via forced SSO on mobile / desktop app and browser plugin
Actual Result
SSO sign-in is required
Logs
Screenshots or Videos
No response
Additional Context
No response
Originally created by @dwtypeofcode on GitHub (Jan 27, 2026).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6762
### Prerequisites
- [x] I have searched the existing **Closed _AND_ Open** [Issues](https://github.com/dani-garcia/vaultwarden/issues?q=is%3Aissue%20) **_AND_** [Discussions](https://github.com/dani-garcia/vaultwarden/discussions?discussions_q=)
- [x] I have searched and read the [documentation](https://github.com/dani-garcia/vaultwarden/wiki/)
### Vaultwarden Support String
I've configured SSO with EntraID with the manual: https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect
I've enabled SSO in docker compose file, I've also enabled SSO_ONLY: true
Now when I try to login to any account via web browser plugin **OR** bitwarden desktop app **OR** android bitwarden app I'm getting error like SSO sign-in required - when typing login - it doesn't redirect me to the O365 login page.
When I disable **SSO_ONLY: true** - it'll work without any problem, but there's another "issue". When you block some account on the EntraID - then user IS STILL ABLE to login via his master password.
### Vaultwarden Build Version
1.35.2
### Deployment method
Official Container Image
### Custom deployment method
_No response_
### Reverse Proxy
nginx 1.22.1
### Host/Server Operating System
Linux
### Operating System Version
Debian
### Clients
Browser Extension
### Client Version
_No response_
### Steps To Reproduce
1. Set SSO_ONLY: true in docker compose
2. Deploy docker container
3. Try to login via browser extension / desktop app / android app.
### Expected Result
To be able to login via forced SSO on mobile / desktop app and browser plugin
### Actual Result
<img width="350" height="70" alt="Image" src="https://github.com/user-attachments/assets/61fbf6ea-eb97-458a-a7de-02a26c490737" />
SSO sign-in is required
### Logs
```text
```
### Screenshots or Videos
_No response_
### Additional Context
_No response_
GiteaMirror
added the bug label 2026-04-20 14:57:00 -05:00
<!-- gh-comment-id:3812202259 -->
@mvalois commented on GitHub (Jan 28, 2026):
You need to click on "Use single sign-on" instead of "continue" : https://bitwarden.com/help/using-sso/
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @dwtypeofcode on GitHub (Jan 27, 2026).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6762
Prerequisites
Vaultwarden Support String
I've configured SSO with EntraID with the manual: https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect
I've enabled SSO in docker compose file, I've also enabled SSO_ONLY: true
Now when I try to login to any account via web browser plugin OR bitwarden desktop app OR android bitwarden app I'm getting error like SSO sign-in required - when typing login - it doesn't redirect me to the O365 login page.
When I disable SSO_ONLY: true - it'll work without any problem, but there's another "issue". When you block some account on the EntraID - then user IS STILL ABLE to login via his master password.
Vaultwarden Build Version
1.35.2
Deployment method
Official Container Image
Custom deployment method
No response
Reverse Proxy
nginx 1.22.1
Host/Server Operating System
Linux
Operating System Version
Debian
Clients
Browser Extension
Client Version
No response
Steps To Reproduce
Expected Result
To be able to login via forced SSO on mobile / desktop app and browser plugin
Actual Result
Logs
Screenshots or Videos
No response
Additional Context
No response
@mvalois commented on GitHub (Jan 28, 2026):
You need to click on "Use single sign-on" instead of "continue" : https://bitwarden.com/help/using-sso/