diff --git a/bewcloud.config.sample.ts b/bewcloud.config.sample.ts
index f39bbd3..67e44b6 100644
--- a/bewcloud.config.sample.ts
+++ b/bewcloud.config.sample.ts
@@ -11,7 +11,7 @@ const config: PartialDeep<Config> = {
     // allowedCookieDomains: ['example.com', 'example.net'], // Can be set to allow more than the baseUrl's domain for session cookies
     // skipCookieDomainSecurity: true, // If true, the cookie domain will not be strictly set and checked against. This skipping slightly reduces security, but is usually necessary for reverse proxies like Cloudflare Tunnel
     // enableSingleSignOn: false, // If true, single sign-on will be enabled
-    // allowSingleSignOnSignups: false, // If true, single sign-on signups will be allowed overriding allowSignups
+    // allowSignupsViaSingleSignOn: false, // If true, signups via single sign-on will be allowed, overriding allowSignups
     // singleSignOnUrl: '', // The Discovery URL (AKA Issuer) of the identity/single sign-on provider
     // singleSignOnEmailAttribute: 'email', // The attribute to prefer as email of the identity/single sign-on provider
     // singleSignOnScopes: ['openid', 'email'], // The scopes to request from the identity/single sign-on provider
diff --git a/lib/config.ts b/lib/config.ts
index 8828e3a..42c4cc6 100644
--- a/lib/config.ts
+++ b/lib/config.ts
@@ -16,7 +16,7 @@ export class AppConfig {
         allowedCookieDomains: [],
         skipCookieDomainSecurity: false,
         enableSingleSignOn: false,
-        allowSingleSignOnSignups: false,
+        allowSignupsViaSingleSignOn: false,
         singleSignOnUrl: '',
         singleSignOnEmailAttribute: 'email',
         singleSignOnScopes: ['openid', 'email'],
@@ -118,10 +118,10 @@ export class AppConfig {
     return this.config;
   }
 
-  static async isSignupAllowed(sso: boolean = false): Promise<boolean> {
+  static async isSignupAllowed({ viaSingleSignOn = false }: { viaSingleSignOn?: boolean } = {}): Promise<boolean> {
     await this.loadConfig();
 
-    const areSignupsAllowed = sso ? this.config.auth.allowSingleSignOnSignups : this.config.auth.allowSignups;
+    const areSignupsAllowed = viaSingleSignOn && !this.config.auth.allowSignups ? this.config.auth.allowSingleSignOnSignups : this.config.auth.allowSignups;
     const areThereAdmins = await UserModel.isThereAnAdmin();
 
     return areSignupsAllowed || !areThereAdmins;
diff --git a/lib/models/oidc.ts b/lib/models/oidc.ts
index 9ef0fb9..fb09070 100644
--- a/lib/models/oidc.ts
+++ b/lib/models/oidc.ts
@@ -169,7 +169,7 @@ export class OidcModel {
       throw new Error(`Missing user/${emailAttribute}`);
     }
 
-    const isSignupAllowed = await AppConfig.isSignupAllowed(true);
+    const isSignupAllowed = await AppConfig.isSignupAllowed({ viaSingleSignOn: true });
     const isThereAnAdmin = await UserModel.isThereAnAdmin();
 
     // Confirm the user exists (or signup if allowed)
@@ -181,9 +181,8 @@ export class OidcModel {
     }
 
     if (!user) {
-      // this will allow admin account creation even if SSO signups are disabled following the foregoing logic
-      if (!config.auth.allowSingleSignOnSignups) {
-        throw new Error('Sign up via SSO is not allowed');
+      if (!config.auth.allowSignupsViaSingleSignOn) {
+        throw new Error('Sign up via SSO is not allowed!');
       }
 
       throw new Error('There was a problem signing up or logging in!');
diff --git a/lib/types.ts b/lib/types.ts
index d852059..e05306c 100644
--- a/lib/types.ts
+++ b/lib/types.ts
@@ -159,8 +159,8 @@ export interface Config {
     skipCookieDomainSecurity: boolean;
     /** If true, single sign-on will be enabled */
     enableSingleSignOn: boolean;
-    /** If true, single sign-on signups will be allowed overriding allowSignups */
-    allowSingleSignOnSignups: boolean;
+    /** If true, signups via single sign-on will be allowed, overriding allowSignups */
+    allowSignupsViaSingleSignOn: boolean;
     /** The Discovery URL (AKA Issuer) of the identity/single sign-on provider */
     singleSignOnUrl: string;
     /** The attribute to prefer as email of the identity/single sign-on provider */