My problem with the SSO providers is not the technical part, thats "easy". Its the coordinate with the 200+ external and internal vendors / support to redeploy the SSO part which is time consuming. I always say its a ~3 year project, which can be done in 6 months with the right amount of resources, especially if the platform has been running for years.

There are the handful that it’s not just a web console or API you interact with. Have to file a support ticket.

Those will be a pain.