We can force users to use SSO only.