Force accounts to sign in using SSO only while retaining non-SSO logins.

[suiramdev]

I reviewed the SSO documentation, and it appears to be all-or-nothing. Even with SSO enabled, users are still prompted for the master password. Ideally, accounts linked to SSO would authenticate exclusively via SSO, while users invited through Vaultwarden or who signed up using email would continue to sign in using their email provider.

[suiramdev]

Correct me If I'm wrong but the SSO_ONLY option is fully disabling master password sign-in for any accounts

[BlackDex]

Not that i know of. You still need a master password to decrypt/unlock the account. As pointed out here too https://bitwarden.com/help/using-sso/#tab-master-password-5SgfI0t7yucjtl8qLjp4Y1

And Vaultwarden only supports the first item i think, not sure about the device approval from the top of my head. Maybe @Timshel is able to answer that.

[Timshel]

Yes, device approval/Trusted devices while probably possible is not implemented.