---
schema_version: "1"
id: f44037549dfdc7aa5a59d1fb3645c2665889debcd8dd6d172d31dd3fa9cc9bab
title: Disabling External Client Apps Now Blocks SAML Login
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/262-0-0/rn_security_eca_saml_disable_enforcement.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_eca_saml_disable_enforcement.htm&release=262.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: c68b5ca0207b4a93c6139a5da943f9ea94bca593b8111d7ef5e12f2dec8b3e77
description: We fixed a security gap where external client apps still allowed SAML single sign-on (SSO) using Salesforce as an identity provider, even when the app or its SAML plugin was disabled. Now, for SSO to work, both the app and the SAML plugin must be enabled. If either one is disabled, the SSO login fails.
products:
  - Cross Cloud
release: "262"
---
# Disabling External Client Apps Now Blocks SAML Login

We fixed a security gap where external client apps still allowed SAML single sign-on (SSO) using Salesforce as an identity provider, even when the app or its SAML plugin was disabled. Now, for SSO to work, both the app and the SAML plugin must be enabled. If either one is disabled, the SSO login fails.

**Where:** This change applies to Lightning Experience and Salesforce Classic in all editions.

**How:** If a user tries to log in to the service provider via Salesforce SSO, Salesforce now checks both the App Status (1) and the SAML Settings (2).

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-release-notes-salesforce_release_notes-262-0-0-production-enus/e945111b-3e0a-4011-accc-d5949363bfcc/images/icon_note.png)

Note If SAML is disabled, the app displays an Enable SAML button.

![External Client App SAML Provider page showing Disabled status (1) and Enable SAML button (2)](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-release-notes-salesforce_release_notes-262-0-0-production-enus/e945111b-3e0a-4011-accc-d5949363bfcc/salesforce_release_notes/images/security_saml_eca_disabled.png)

If either one is disabled, the user sees an error. The error message is different depending on the [SAML SSO flow](https://help.salesforce.com/s/articleView?id=xcloud.identity_provider_about.htm&language=en_US).

- Service provider-initiated flow: The user sees a single sign-on error with the message "We can't log you in because of an issue with single sign-on. Contact your Salesforce admin for help.
- Identity provider-initiated flow: The user sees an insufficient privileges error.

Salesforce also logs the failure in the Identity Provider Event Log as "Error: External client app or its SAML plugin is disabled."

#### See Also

- [_Salesforce Help_: Configure the External Client App's SAML 2.0 Settings and Policies](https://help.salesforce.com/s/articleView?id=xcloud.configure_external_client_app_saml.htm&language=en_US)