diff --git a/packages/twenty-server/src/engine/core-modules/auth/auth.resolver.ts b/packages/twenty-server/src/engine/core-modules/auth/auth.resolver.ts
index 67529abe10..813e04e28f 100644
--- a/packages/twenty-server/src/engine/core-modules/auth/auth.resolver.ts
+++ b/packages/twenty-server/src/engine/core-modules/auth/auth.resolver.ts
@@ -350,25 +350,16 @@ export class AuthResolver {
     twoFactorAuthenticationVerificationInput: TwoFactorAuthenticationVerificationInput,
     @Args('origin') origin: string,
   ): Promise<AuthTokens> {
-    const { sub: email, authProvider } =
-      await this.loginTokenService.verifyLoginToken(
-        twoFactorAuthenticationVerificationInput.loginToken,
-      );
-
-    const workspace =
-      await this.workspaceDomainsService.getWorkspaceByOriginOrDefaultWorkspace(
-        origin,
-      );
-
-    assertIsDefinedOrThrow(
-      workspace,
-
-      new AuthException(
-        'Workspace not found',
-        AuthExceptionCode.WORKSPACE_NOT_FOUND,
-      ),
+    const {
+      sub: email,
+      authProvider,
+      workspaceId,
+    } = await this.loginTokenService.verifyLoginToken(
+      twoFactorAuthenticationVerificationInput.loginToken,
     );
 
+    const workspace = await this.validateWorkspaceAccess(origin, workspaceId);
+
     const user = await this.userService.findUserByEmailOrThrow(email);
 
     await this.twoFactorAuthenticationService.validateStrategy(
diff --git a/packages/twenty-server/src/engine/core-modules/auth/controllers/sso-auth.controller.ts b/packages/twenty-server/src/engine/core-modules/auth/controllers/sso-auth.controller.ts
index a814111d71..01f1b90e18 100644
--- a/packages/twenty-server/src/engine/core-modules/auth/controllers/sso-auth.controller.ts
+++ b/packages/twenty-server/src/engine/core-modules/auth/controllers/sso-auth.controller.ts
@@ -34,6 +34,7 @@ import { GuardRedirectService } from 'src/engine/core-modules/guard-redirect/ser
 import { SSOService } from 'src/engine/core-modules/sso/services/sso.service';
 import {
   IdentityProviderType,
+  SSOIdentityProviderStatus,
   WorkspaceSSOIdentityProviderEntity,
 } from 'src/engine/core-modules/sso/workspace-sso-identity-provider.entity';
 import { UserService } from 'src/engine/core-modules/user/services/user.service';
@@ -138,7 +139,10 @@ export class SSOAuthController {
       });
 
     try {
-      if (!workspaceIdentityProvider) {
+      if (
+        !workspaceIdentityProvider ||
+        workspaceIdentityProvider.status !== SSOIdentityProviderStatus.Active
+      ) {
         throw new AuthException(
           'Identity provider not found',
           AuthExceptionCode.OAUTH_ACCESS_DENIED,
@@ -167,6 +171,13 @@ export class SSOAuthController {
         ),
       );
 
+      if (currentWorkspace.id !== workspaceIdentityProvider.workspaceId) {
+        throw new AuthException(
+          'Identity provider does not belong to this workspace',
+          AuthExceptionCode.OAUTH_ACCESS_DENIED,
+        );
+      }
+
       const oidcTokenClaims =
         'oidcTokenClaims' in req.user ? req.user.oidcTokenClaims : undefined;