diff --git a/enterprise/app/controllers/enterprise/devise_overrides/sessions_controller.rb b/enterprise/app/controllers/enterprise/devise_overrides/sessions_controller.rb
index fae0298cc..17e3ad682 100644
--- a/enterprise/app/controllers/enterprise/devise_overrides/sessions_controller.rb
+++ b/enterprise/app/controllers/enterprise/devise_overrides/sessions_controller.rb
@@ -36,13 +36,13 @@ module Enterprise::DeviseOverrides::SessionsController
   private
 
   def check_saml_user
-    # Skip if using SSO token (SAML users can use SSO tokens)
-    return if params[:sso_auth_token].present?
     return if params[:email].blank?
 
     user = User.from_email(params[:email])
     return unless user&.provider == 'saml'
 
+    return if params[:sso_auth_token].present? && user.valid_sso_auth_token?(params[:sso_auth_token])
+
     raise CustomExceptions::Base.new(I18n.t('messages.login_saml_user'), :unauthorized)
   end
 end