What it does
Sign-in protection stands in front of a deployment — a Web App or a serverless agent — using your own identity provider rather than a login screen you build and maintain. Unauthenticated visitors are redirected to your identity provider. Your app must still enforce its own permissions. If it uses forwarded identity claims, it must verify their signature, issuer, expiry, and intended signer before trusting them.
Setup
Open Projects → your project → Settings → Deployment Protection and turn on sign-in protection and supply your identity provider’s issuer URL along with the client ID and secret it gave you. The platform reads the provider’s configuration from the issuer automatically, then applies it — no redeploy, and no change to your app’s code. Visitors who aren’t signed in are sent to your provider’s own sign-in prompt first; once they authenticate, they’re returned straight to the app.
Removing it
Turn it off from the same place. After the update succeeds, protection is removed and the deployment goes back to serving requests directly. Your provider settings stay filled in for next time — except the client secret, which the platform never stores, so turning protection back on means entering it again.
This control requires a deployed web-app or serverless listener. It is not available for static-site deployments, and it is separate from Web Firewall and Bot Protection in the project’s Security tab.