Skip to lesson
Exit
Cursor Product & Architecture1 / 2

2 min lesson

Auth, SSO and admin

Rebuild the main list in "Auth, SSO and admin", then say what each item changes.

Step 1 of 2

Auth, SSO and admin

Enterprise auth is its own category. SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition./SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. sits between the user and the product, so a failed login is frequently an identity-provider configuration issue rather than a Cursor bug. Admin and team management explains a lot of "why can't I do X" tickets.

  • SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition./SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition.. Login loops or "access denied" often trace to the IdP config: wrong assertion mapping, an unprovisioned user or a domain not verified. Confirm with the admin before assuming a defect.
  • Admin / team management. Seat assignment, role and policy govern what a user can do. Many capability complaints are policy, working as configured.
  • Admin data controls. Enterprise admins can set repository, model and MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. access controls and team-wide privacy settings. Check admin policy and ignore files before treating restricted behavior as broken. Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition. itself is a no-training guarantee.
Legacy privacy mode blocks cloud agents

A specific, non-obvious gotcha that generates real tickets: cloud agents are available in Privacy ModeCursor's setting that guarantees code data is not used for training by Cursor or its model providers, and that an admin can enforce org-wide; data-retention terms are a separate, contractual layer. Press Enter for the full definition., where Cursor never trains on your code and only retains it to run the agent. They do not work with legacy privacy mode.

The reason is mechanical: a cloud agent needs the codebase stored for the run, which legacy privacy mode doesn't allow. Mobile agents carry the same rule, and Cursor says the switch off legacy mode can't be reversed. A user who reports "cloud agents won't start" isn't hitting a bug. Confirm which mode is set before escalating.