diff --git a/src/apps.js b/src/apps.js
index e453c80e0..4282b5456 100644
--- a/src/apps.js
+++ b/src/apps.js
@@ -504,6 +504,8 @@ function install(data, auditSource, callback) {
         if (error) return callback(error);
 
         if ('sso' in data && !('optionalSso' in manifest)) return callback(new AppsError(AppsError.BAD_FIELD, 'sso can only be specified for apps with optionalSso'));
+        // if sso was unspecified, enable it by default if possible
+        if (sso === null) sso = manifest.addons['simpleauth'] || manifest.addons['ldap'] || manifest.addons['oauth'];
 
         if (altDomain !== null && !validator.isFQDN(altDomain)) return callback(new AppsError(AppsError.BAD_FIELD, 'Invalid alt domain'));
 
@@ -525,17 +527,6 @@ function install(data, auditSource, callback) {
         purchase(appId, appStoreId, function (error) {
             if (error) return callback(error);
 
-            // FIXME revise this once customAuth is gone
-            if (sso === null) {
-                if (manifest.customAuth) {
-                    sso = false;
-                } else if (manifest.addons['simpleauth'] || manifest.addons['ldap'] || manifest.addons['oauth']) {
-                    sso = true;
-                } else {
-                    sso = false;
-                }
-            }
-
             var data = {
                 accessRestriction: accessRestriction,
                 memoryLimit: memoryLimit,