Organizations that enforce single sign-on already required it on their dashboard. Signing in to the Tuist CLI, the Tuist app, an MCP client or the API reference creates a credential that acts for you in every organization you belong to, so that now requires it too: if you signed in another way, Tuist sends you to your organization's provider first, and sign-in with an email and password or with Apple is refused.
The check also runs whenever one of these clients renews its credential. Existing credentials keep working if you have signed in through your organization's provider before. Otherwise they keep renewing for four weeks, and then the client asks you to sign in again; signing in through your provider once in that time, on the dashboard or with tuist auth login, avoids it. If you belong to several organizations that enforce single sign-on, one session can't satisfy all of them, so ask an organization admin for help.