> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cedarai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Gradual rollout

> Enable SSO safely with an option to fall back to Cedar identity during rollout.

Switching to Single Sign-On (SSO) doesn’t have to be all‑or‑nothing. Gradual rollout lets you turn on SSO for your organization while keeping a safe fallback to Cedar identity for select users.

## What is gradual rollout?

* By default, when SSO is enabled for your organization (domain/tenant), users sign in with SSO.
* With gradual rollout, you can allow specific users to continue using Cedar identity temporarily while you complete your SSO rollout.

<Tip>
  This is ideal for large teams, staged rollouts, or when you want a safety net while testing SSO with a subset of
  users.
</Tip>

## How it works (at a glance)

<Columns>
  <Card title="Default (SSO only)" icon="right-to-bracket">
    Users are directed to sign in with your configured identity provider (e.g., Okta, Microsoft, Google).
  </Card>

  <Card title="Gradual rollout" icon="shuffle">
    SSO is on, and selected users can still sign in with Cedar identity during the transition.
  </Card>
</Columns>

## What your users see

* When gradual rollout is enabled, affected users will see a friendly option to use Cedar identity if SSO isn’t working for them yet.
* Everyone else signs in with SSO as usual.

## When to use it

* You’re piloting SSO with a smaller group first
* You have mixed user bases (contractors, external partners) and need time to migrate
* You want a straightforward fallback plan during cutover

## Rolling back a single user

If a user can’t sign in with SSO during rollout, an administrator can quickly switch them back to Cedar identity while you investigate. This change is reversible, and the rest of your users remain on SSO.

<Note>
  Contact your Cedar support representative if you’d like help enabling gradual rollout or planning a phased migration.
</Note>

## FAQs

<AccordionGroup>
  <Accordion title="Is gradual rollout available for all providers?" icon="info">
    Yes. Gradual rollout is supported for Google, Okta, and Microsoft (Azure AD).
  </Accordion>

  <Accordion title="Does this affect security?" icon="shield">
    No. Your organization remains protected. Gradual rollout only allows a subset of users to sign in with Cedar
    identity while SSO is being phased in.
  </Accordion>

  <Accordion title="How do we enable it?" icon="gear">
    Your Cedar representative can turn it on for your tenant/domain and guide you through a staged rollout.
  </Accordion>
</AccordionGroup>