> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Access Manager SSO preflight and fixed-organization setup

> Access Manager documentation now covers non-mutating SSO preflight validation and the fixed-organization option for single-tenant BYOC.

<Badge stroke icon="calendar-days" iconType="regular">August 11, 2026</Badge> <Badge stroke icon="file-code" iconType="regular">Documentation update</Badge> <Badge color="yellow" size="lg" stroke icon="triangle-exclamation" iconType="regular">Review recommended</Badge>

## Affects

***

Teams that configure **Access Manager** SSO, particularly single-tenant BYOC deployments with a fixed Casdoor organization.

## What changed

***

The documentation now covers SSO provider preflight validation. Before saving a candidate provider, the check validates configuration, OIDC discovery, client credentials, and the callback redirect URI without creating or changing a provider, application-provider link, or application.

It also documents `PLUGIN_AUTH_SSO_STATIC_ORGANIZATION` for a single-tenant BYOC deployment with one fixed Casdoor organization. Pre-login SSO resolves requests to that organization instead of looking up an `emaildomain:` organization tag. Do not set this variable when `MULTI_TENANT_ENABLED=true`.

This entry documents the available behavior; it does not announce a runtime change.

## Impact

***

**Classification: Review recommended.** Preflight can reduce configuration risk before an SSO provider is saved. The fixed-organization setting is only appropriate for a single-tenant deployment and is incompatible with multi-tenancy.

## What you need to do

***

Use preflight validation before saving an SSO provider. If you operate a single-tenant BYOC deployment with one fixed organization, evaluate whether `PLUGIN_AUTH_SSO_STATIC_ORGANIZATION` fits your setup. Never enable it with `MULTI_TENANT_ENABLED=true`.

### Deadline

No product-imposed deadline.

## Resources

***

* [Identity plugin](/en/platform/access-manager/identity-plugin)