diff --git a/config/sso.example.js b/config/sso.example.js
index 1393967d7..c11035f5f 100644
--- a/config/sso.example.js
+++ b/config/sso.example.js
@@ -7,11 +7,11 @@ module.exports = {
     // Enable SSO login on this instance
     enabled: false,
     // Block registration for non-SSO users on this instance
-    enforced: false,
+    enforced: true,
     // Allow users to add an additional CryptPad password to their SSO account
-    cpPassword: false,
+    cpPassword: true,
     // You can also force your SSO users to add a CryptPad password
-    forceCpPassword: false,
+    forceCpPassword: true,
     // List of SSO providers
     list: [
     /*
diff --git a/customize.dist/pages/login.js b/customize.dist/pages/login.js
index b1b830c3d..0898eefe5 100644
--- a/customize.dist/pages/login.js
+++ b/customize.dist/pages/login.js
@@ -15,7 +15,7 @@ define([
         const ssoLength = Config?.sso?.list?.length;
         const forceStandardLogin = window.location.hash === "#standard-login";
         var ssoEnabled = (ssoLength && !forceStandardLogin) ? '': '.cp-hidden';
-        var ssoEnforced = (Config?.sso?.force && !forceStandardLogin) ? '.cp-hidden' : '';
+        var ssoEnforced = (Config?.sso?.force && !forceStandardLogin && ssoLength) ? '.cp-hidden' : '';
         if (ssoLength === 1 && ssoEnforced) {
             // SSO enforced and only one provider:
             // skip login page
diff --git a/lib/http-worker.js b/lib/http-worker.js
index 03dac79c7..bf0747e10 100644
--- a/lib/http-worker.js
+++ b/lib/http-worker.js
@@ -617,11 +617,15 @@ var makeRouteCache = function (template, cacheName) {
 
 var serveConfig = makeRouteCache(function () {
     // NOTE: we may extract JSON from this config using slice(27, -5)
-    const ssoList = Env.sso && Env.sso.enabled && Array.isArray(Env.sso.list) &&
+    const ssoList = Env.sso && Array.isArray(Env.sso.list) &&
                     Env.sso.list.map(function (obj) { return obj.name; }) || [];
-    const ssoCfg = (SSOUtils && ssoList.length) ? {
-        force: (Env.sso && Env.sso.enforced && 1) || 0,
-        password: (Env.sso && Env.sso.cpPassword && (Env.sso.forceCpPassword ? 2 : 1)) || 0,
+    let forceSso = Env?.sso?.enforced ?? true;
+    let allowPw = Env?.sso?.cpPassword ?? true;
+    let forcePw = Env?.sso?.forceCpPassword ?? true;
+    const ssoCfg = (Env?.sso?.enabled) ? {
+        enabled: Env?.sso?.enabled,
+        force: forceSso ? 1 : 0,
+        password: allowPw && (forcePw ? 2 : 1) || 0,
         list: ssoList
     } : false;