> ## Documentation Index
> Fetch the complete documentation index at: https://enterprise-docs.dify.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Access Control

> Published web apps are public by default; require SSO sign-in for individual apps when your organization enables WebApp SSO.

Published web apps are public by default: anyone with the app URL can use it without signing in. When an app should not be open to everyone, your organization can require SSO sign-in for it.

<Info>
  Only Workspace Owner, Admin, and Editor roles can create and publish web apps.
</Info>

## Require SSO Sign-In

WebApp SSO works on two levels:

1. **Enterprise level**: An enterprise administrator enables WebApp SSO in the admin console and selects one protocol: SAML, OIDC, or OAuth2. See [SSO Authentication](/en/2.5.x/administer/sso/introduction).
2. **App level**: Open the app's **Monitoring** page and click **Settings** on the web app card. The **WebApp SSO** switch in the **SSO Enforcement** section controls whether visitors must sign in through your organization's SSO before using that app.

If the WebApp SSO switch is greyed out, your administrator has not enabled WebApp SSO yet — the switch shows "Contact the administrator to enable WebApp SSO". Only workspace Editors and above can change the setting.

Each published app is therefore in one of two states: public, or SSO-protected. Any user who can sign in through your organization's SSO can use an SSO-protected app.

## Find Your Apps

Workspace members signed in to Dify see the workspace's apps on the **Explore** page and can open them from there.

## Common Questions

<AccordionGroup>
  <Accordion title="Do access changes require republishing?">
    No. Turning WebApp SSO on or off takes effect for new visits immediately; no republish is needed.
  </Accordion>

  <Accordion title="Do web app access settings affect API access?">
    No. API access is controlled separately by API keys. Changing web app access doesn't affect existing API functionality.
  </Accordion>
</AccordionGroup>