Back to Checks
vercel

Vercel team enforces SAML SSO for all members

team_saml_sso_enforced
Service: teamSeverity: critical
OfficialBuilt-inVerified
Categories:trust-boundariesvercel-pro-plan
Resource Type:NotDefined

Vercel team is assessed for SAML SSO enforcement across all members. When enforced, all team members must authenticate through the configured identity provider, preventing the use of individual Vercel credentials.

Prowler logoProwlerprowler-provider-vercel

Risk

Without SAML SSO enforcement, team members can bypass centralized authentication and log in with individual credentials even when SAML is configured. This undermines identity governance, allows circumvention of MFA policies, and creates gaps in access auditing.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler vercel --checks team_saml_sso_enforced

Recommendation

Enforce SAML SSO for all team members to ensure authentication is managed exclusively through your identity provider. This prevents credential bypass, enforces MFA policies, and provides centralized access control and audit capabilities.

Remediation

Other

1Navigate to your Vercel team settings
2Go to the Security section
3Ensure SAML SSO is configured and linked
4Enable SSO enforcement to require all members to authenticate via the identity provider

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportVercel
from prowler.providers.vercel.lib.billing import plan_reason_suffix
from prowler.providers.vercel.services.team.team_client import team_client


class team_saml_sso_enforced(Check):
    """Check if SAML SSO enforcement is enabled for the Vercel team.

    This class verifies whether the Vercel team enforces SAML SSO,
    requiring all members to authenticate through the identity provider.
    """

    def execute(self) -> List[CheckReportVercel]:
        """Execute the Vercel Team SAML SSO Enforced check.

        Iterates over all teams and checks if SAML SSO is enforced.

        Returns:
            List[CheckReportVercel]: A list of reports for each team.
        """
        findings = []
        for team in team_client.teams.values():
            report = CheckReportVercel(
                metadata=self.metadata(),
                resource=team,
                resource_name=team.name,
                resource_id=team.id,
            )

            if team.saml and team.saml.enforced:
                report.status = "PASS"
                report.status_extended = (
                    f"Team {team.name} enforces SAML SSO for all members."
                )
            else:
                report.status = "FAIL"
                if team.saml and team.saml.status == "enabled":
                    report.status_extended = (
                        f"Team {team.name} has SAML SSO enabled but does not enforce it. "
                        f"Members can still authenticate without SSO."
                    )
                else:
                    report.status_extended = (
                        f"Team {team.name} does not have SAML SSO enforced."
                        f"{plan_reason_suffix(team.billing_plan, {'hobby'}, 'SAML SSO is not available on the Vercel Hobby plan.')}"
                    )

            findings.append(report)

        return findings

References