Skip to content
English
More support Customer portal
Contact us
  • There are no suggestions because the search field is empty.

Will our people be locked out of Canva when we activate Single Sign On?

When you move to Canva Enterprise you verify your email domains, which gives you authority over the Canva accounts your staff already have. The obvious worry is that this cuts people off. It is the first question we are asked on every rollout.

Part of Setting up Canva Enterprise: how the rollout works, a guide from Refuel Creative for organisations moving to Canva Enterprise.

When you move to Canva Enterprise you verify your email domains, which gives you authority over the Canva accounts your staff already have. The obvious worry is that this cuts people off. It is the first question we are asked on every rollout.

When this applies: While you are turning on single sign-on, and any time you change your SSO login setting afterwards.

Short answer: only if you choose a setting that does that. It does not happen on its own.

Nothing locks anyone out automatically. Verifying a domain does not block access, and neither does the 30 day window that follows it.

Whether existing Canva users on your domain keep working normally is decided by exactly one setting: your SSO signup and login control. There are three options:

  1. SSO optional for everyone. Nothing changes for people outside your team. They carry on exactly as they do today.

  2. SSO required for everyone on your team. Still nothing changes for people outside your team. Canva's wording: "Existing Canva users who are not part of the team can log in to Canva using SSO or other methods."

  3. SSO required for everyone, even outside your team. People outside your team must link their account to your identity provider or change their email address. Anyone without a working account in your identity provider cannot get in.

Only the third option produces a lockout, and only for people who have no working login in your identity provider.

What we recommend

Launch on "SSO required for everyone on your team". It gives you full control of the people you are managing without touching anyone else. You can tighten it later, once your user list is complete and you have confirmed everyone who needs access has a working account in your identity provider.

There is no benefit to going straight to the strictest setting on day one, and a real cost if your user list turns out to be incomplete.

A common misunderstanding

People often believe accounts are automatically blocked 30 days after a domain is verified. They are not. At the end of the 30 days an account becomes affiliated with your organisation, which changes what the user can do with their own account settings but does not affect their access.

Related articles

Canva documentation

Canva updates its documentation without notice. If something here no longer matches what you see in your account, tell us and we will check it.