Bring your towel and join one of the fastest growing data communities. Welcome to our second-generation open source orchestration platform, a completely rethought approach to dataflow automation.

Prefect Community

<@ULVA73B9P> Is it possible to enforce 2FA or SSO in prefect?

:white_check_mark: thought for 116.3 seconds

Short answer:
- SSO enforcement: Yes, in Prefect Cloud (Enterprise). You can require users from specified domains to sign in via your IdP (OIDC or SAML). Owners can bypass SSO; other users cannot.
- 2FA/MFA: Not built into Prefect Cloud directly. Use your identity provider’s MFA—when SSO is enforced, MFA policies from your IdP apply to Prefect.

Details and setup:
- Configure and enforce SSO: <https://docs.prefect.io/v3/how-to-guides/cloud/manage-users/configure-sso|Configure SSO in Prefect Cloud>
- Role capabilities (including the Owner SSO bypass note): <https://docs.prefect.io/v3/how-to-guides/cloud/manage-users/manage-roles|Manage account roles>

Notes:
- These controls are for Prefect Cloud (3.x). If you’re self-hosting open-source Prefect, there’s no built-in auth—you’d front it with your own IdP/reverse proxy to enforce SSO/MFA.
- Complementary controls (Enterprise): IP allowlisting <https://docs.prefect.io/v3/how-to-guides/cloud/manage-users/secure-access-by-ip-address|Secure access by IP address> and directory sync/SCIM via your IdP.

Which edition are you on (Cloud Free/Pro/Enterprise or self-hosted)? If Cloud Enterprise, I can outline the exact steps to turn on SSO enforcement for your domains.