From e3656b0e8b6c45bc1cf31dbc452cd00304791d75 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 24 Sep 2026 07:24:16 +0000
Subject: [PATCH] docs: sync cloud-web with merged PRs (2026-09-24)

---
 packages/kilo-docs/pages/collaborate/enterprise/sso.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/packages/kilo-docs/pages/collaborate/enterprise/sso.md b/packages/kilo-docs/pages/collaborate/enterprise/sso.md
index 3397f7481513..f2564c2537b6 100644
--- a/packages/kilo-docs/pages/collaborate/enterprise/sso.md
+++ b/packages/kilo-docs/pages/collaborate/enterprise/sso.md
@@ -61,3 +61,10 @@ After enabling SSO:
 - Invite new users with their company email domain.
 - Manage team access and roles from the **[Organization](/docs/collaborate/adoption-dashboard/overview)** tab.
 - View user activity across the team in the **[Audit Logs](/docs/collaborate/enterprise/audit-logs)** tab
+
+## Signing in with SSO
+
+When you open an SSO sign-in link, Kilo checks whether your browser is already signed in to Kilo with a different address than the one the link requests. If the addresses differ, sign-in stops and Kilo shows a **Wrong account signed in** page instead of continuing. The page names the address the app requested and the address currently signed in, with a single button that signs out of the current browser session and returns you to SSO sign-in for the expected address. The switch keeps the original callback path and device code, so sign-in completes for the right account once you sign in with it. A matching address continues to the callback path unchanged.
+
+Kilo trims spaces and ignores case when comparing addresses. A request without an `email` keeps the previous behavior, and an explicit `email` in the sign-in URL takes precedence over a remembered returning-user address when the form is prefilled.
+