Hey team! It seems I can't access a sub-tenant of a parent tenant if SSO is enforced unless I add myself to the SSO exclusion list. Is this behavior by design? I would expect to be able to access all my sub-tenants regardless of their authentication method. Is this possible?

Tenant Inheritance & SSO Enforcement This behavior is by design and follows Descope's tenant inheritance rules. When SSO is enforced on a sub-tenant, authentication must follow that tenant's authentication method . How Bottom-Up Association Works Descope follows a "bottom-up association" model where sub-tenant assignments don't automatically grant parent tenant access . Users with roles in a parent tenant automatically receive the same roles in all sub-tenants, but the reverse isn't true . Workaround Options 1. Add yourself to the SSO exclusion list for the sub-tenant (as you've done) 2. Configure SSO inheritance from parent to sub-tenant if using the same SSO provider 3. Ensure your user account has explicit roles in both parent and sub-tenants The SSO enforcement is designed to maintain security boundaries between tenants while allowing flexible authentication methods per organization. How Descope Uses Descope for Customer Authentication Sub-tenants | Descope Documentation

Hey Tal, the AI summary did actually provide the right answer, the subTenant currently follows the parent tenant's SSO + enforce settings can you please elaborate on what the use case?

Hey @Reuven Zabirov We have some clients that enforce SSO for their internal usage, but as a parent tenant, I want to be able to access those clients without the need to take care of exclusion list or special behavior

Thanks for clarifying this, Is SubTenants your current and definitive implementation? If so, how urgent is this particular need?

@Reuven Zabirov Yes, this is our current implementation. I believe the expected behavior should be: a checkbox for parent tenants to exclude their children from SSO. As for urgency, we would need it as soon as possible. It is not a blocker for us, but an important requirement.

Hey Tal, I've opened an internal issue to address this. Will keep you posted CC @Doron Sharon

Hey any update? @Doron Sharon

We are still looking into this, if a customer decided to enforce SSO, ignoring that decision might have a security risk, and there are other concerns here. Adding @Dan Sarel and @Yaara Tzur from our product, we will set a meeting to understand the exact use case.

@Tal Mikey can you please share your availability?

@Yaara Tzur https://calendar.app.google/N3Rp8hbV3TGB1Tmy5

Sent an invite for Thursday.