---
title: Enable SSO Only Mode
description: A flag to enable SSO only mode:
component: web-agents
version: 2025.11
page_id: web-agents:properties-reference:com.sun.identity.agents.config.sso.only
canonical_url: https://docs.pingidentity.com/web-agents/2025.11/properties-reference/com.sun.identity.agents.config.sso.only.html
---

# Enable SSO Only Mode

A flag to enable SSO only mode:

* `true`: The agent manages only user authentication. The filter invokes the AM Authentication Service to verify the identity of the user. If the user's identity is verified, the user is issued a session token through AM's Session Service.

* `false`: The agent manages user authorization, by using the policy engine in AM.

|   |                                                                                                              |
| - | ------------------------------------------------------------------------------------------------------------ |
|   | In SSO-only mode, consider configuring [Reset Idle Timeout](com.forgerock.agents.call.session.refresh.html). |

Default: `false`

|                    |                                                                         |
| ------------------ | ----------------------------------------------------------------------- |
| Property name      | `com.sun.identity.agents.config.sso.only`   Introduced in Web Agent 4.x |
| Function           | General                                                                 |
| Type               | Boolean: `true` returns true; all other strings return `false`.         |
| Bootstrap property | No                                                                      |
| Required property  | No                                                                      |
| Restart required   | No                                                                      |
| AM console         | Tab: `Global (From AM 7)`Title: `Enable SSO Only Mode`                  |