require SSO by default