> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cedarai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Gradual rollout

> Enable SSO safely with an option to fall back to Cedar identity during rollout.

Switching to Single Sign-On (SSO) doesn’t have to be all‑or‑nothing. Gradual rollout lets you turn on SSO for your organization while keeping a safe fallback to Cedar identity for select users.

## What is gradual rollout?

* By default, when SSO is enabled for your organization (domain/tenant), users sign in with SSO.
* With gradual rollout, you can allow specific users to continue using Cedar identity temporarily while you complete your SSO rollout.

<Tip>
  This is ideal for large teams, staged rollouts, or when you want a safety net while testing SSO with a subset of
  users.
</Tip>

## How it works (at a glance)

<Columns>
  <Card title="Default (SSO only)" icon="right-to-bracket">
    Users are directed to sign in with your configured identity provider (e.g., Okta, Microsoft, Google).
  </Card>

  <Card title="Gradual rollout" icon="shuffle">
    SSO is on, and selected users can still sign in with Cedar identity during the transition.
  </Card>
</Columns>

## What your users see

* When gradual rollout is enabled, affected users will see a friendly option to use Cedar identity if SSO isn’t working for them yet.
* Everyone else signs in with SSO as usual.

## When to use it

* You’re piloting SSO with a smaller group first
* You have mixed user bases (contractors, external partners) and need time to migrate
* You want a straightforward fallback plan during cutover

## Rolling back a single user

If a user can’t sign in with SSO during rollout, an administrator can quickly switch them back to Cedar identity while you investigate.⁠​​‌​‌​‌‌​‌​​‌​‌​‌​‌‌‌‌​‌⁠ This change is reversible, and the rest of your users remain on SSO.

<Note>
  Contact your Cedar support representative if you’d like help enabling gradual rollout or planning a phased migration.
</Note>

## FAQs

<AccordionGroup>
  <Accordion title="Is gradual rollout available for all providers?" icon="info">
    Yes.⁠​​‌​‌​‌‌​‌​​‌​‌​‌​‌‌‌‌​‌⁠ Gradual rollout is supported for Google, Okta, and Microsoft (Azure AD).
  </Accordion>

  <Accordion title="Does this affect security?" icon="shield">
    No. Your organization remains protected. Gradual rollout only allows a subset of users to sign in with Cedar
    identity while SSO is being phased in.
  </Accordion>

  <Accordion title="How do we enable it?" icon="gear">
    Your Cedar representative can turn it on for your tenant/domain and guide you through a staged rollout.
  </Accordion>
</AccordionGroup>


## Related topics

- [Microsoft](/user-docs/sso/microsoft.md)
- [Okta](/user-docs/sso/okta.md)
- [Overview](/user-docs/sso/overview.md)