Will users on the same domain be affected after setting up SSO?

[GoGoGriffster]

One of our teams has a Dropbox Business account and we want to move them to use SSO via Okta.

After setting up SAML SSO for this account, will this affect any other users from the same domain?  What happens when users on this account go to Dropbox.com to sign in?  Do they just get redirected to the SSO portal?

thanks in advance

Greg

[Walter]

Hey @GoGoGriffster, thanks for using Dropbox and posting on our Community!

This would depend on the way the team's admin has set it up, Greg. 

If the team's admin has made SSO optional, members of the team will be able to use either sign-in method. They can sign in to the team's page with their SSO password for work, or, they can click Log in with Dropbox credentials to sign in with their Dropbox password.

I hope this helps!
 

[GoGoGriffster]

Thanks. I read about that.

My question is though if other domain users that are not assigned in this Dropbox business account will be affected.

[Walter · Accepted solution]

Ah, I see now. Thanks for the clarification @GoGoGriffster

They won't get affected unless the team admin has also enabled domain verification and invite enforcement. 

[GoGoGriffster]

One more question....

I've set up SSO as optional, is it possible to force all @uts.edu.au users in this dropbox account to use SSO and other external addresses to use Dropbox login?

If I set SSO to required, does that mean I will have to have external users in Okta?

I'm thinking I don't want to enable Domain verification as it will affect anyone that has a personal account using their @uts.edu.au email address?

[Walter]

I don't believe this would be an option with SSO set as optional @GoGoGriffster - you'd also need to notify the team yourself this way. 

When it comes to your question about Okta, could you elaborate a tad please? By external users, do you mean people on the same domain but not already in the team account?

In regards to your last concern, I believe you're referring to the invite enforcement feature, which can be enabled after domain verification has been completed.

This will require all invited users with a personal Dropbox account created using an email on the verified domain to select from one of two options:

• Join the team with their existing account.
• If their account has mostly personal content, they can change the email address associated with this account to a new personal email address. This will keep their existing content separate from the business account.

I'm not sure if this would help in this case, but, perhaps, domain insights and account capture is what you're looking for?

[GoGoGriffster]

Firstly, @Walter thanks for that last bit of information, that will be immensely helpful I believe.

I think we’re just going to stick with optional SSO as it seems by design, if a user has SSO enabled, the login dialog changes to SSO by default.

By external users I meant those not in primary domains in Okta (@uts.edu.au, @student.uts.edu.au).  Setting invite enforcement might cause issues with these external accounts and api connections etc that are currently in place.