I guess the claim is that, if you want your little team in MegaCorp to use a little Sass app, you're going to have to either :

- create user accounts at LittleApp, with your personal email, and have to remember a password.

Then, you're potentially giving sensitive corporate info to the SaaS app, with your personal email, and you risk getting fired for that.

Plus,new passwords are annoying !

- so you try integrating with the SSO solution from your MegaCorp, which means you have to talk to IT. Which means:

A/ you're going to have to wait because they're busy telling people to switch it off an on again ;

B/ they're now in a position to exert power over a decision you would like to make. Politics will ensue.

Oh, ok, that makes sense. But there are a couple of fixes. You create the account with your corporate email. You just need the password.

And that part: you're potentially giving sensitive corporate info to the SaaS app, with your personal email, and you risk getting fired for that

If that one part is real, than SSO isn't adding any power to you (or to the DSO anyway). If it isn't, then the only thing SSO changes is the password one.