SSO is the obvious security win, but it looks like the hard part is mapping identity groups to helpdesk roles. If an agent moves teams, does the role change automatically, or does someone have to remember? I'm leaning toward mapping roles from groups so access follows the person, but the setup looks fiddly. Is it worth it for a team under 50? Or do you keep SSO for login and manage roles by hand? What went wrong for you when people changed teams or left?