Optional. Point this at Entra ID, Google Workspace, Keycloak or any OIDC provider. Local password login and 2FA never stop working — if SSO is misconfigured you can still sign in normally, so a bad issuer can never lock you out of your own register.
Sign-in only works for accounts that already exist here — SSO does not create logins. Invite people under Team first, so membership of your identity tenant never silently becomes access to the office.