diff --git a/ssoauth/app_settings/__init__.py b/ssoauth/app_settings/__init__.py
index 1b756823fc3594c7e612c754bc7c68ee1df41bd9..61836c1abc1104f828f0f0c0c305626858a8ac06 100644
--- a/ssoauth/app_settings/__init__.py
+++ b/ssoauth/app_settings/__init__.py
@@ -18,8 +18,9 @@ for setting_name in [k for k in globals().keys() if k.isupper()]:
 # checks
 
 SSO_DISABLED = SSO_DISABLED or getattr(conf.settings, "IDP_IGNORE", False)  # legacy config
-if not SSO_DISABLED:
-    assert not conf.settings.DEBUG, "Not ignoring IDP on production."
+if SSO_DISABLED:
+    assert conf.settings.DEBUG, "Not ignoring IDP on production."
+else:
     assert SP_HOST and SP_PORT, "Need SP_HOST and SP_PORT configured in settings."
     assert not SP_HOST.lower().startswith(("http:", "https:",)), "Need host name without protocol and port."