Is it possible to stay logged in to production and sandbox simultaneously? my users seem to have a lot of trouble with this, when they log into one, it often (but not always) logs them out of the other

What others have said is true, do not use the "change roles" feature (this will log you out of production and log you into sandbox for example). What @michoel said is correct about bookmarks - or you can duplicate the tab and edit the URL manually. So you should have https://123456.app.netsuite.com/pages/customerlogin.jsp then duplicate that tab and add "-sb1" to the URL in the second tab: https://123456-sb1.app.netsuite.com/pages/customerlogin.jsp

We use SAML SSO (OKTA). We can be in different environments at the same time using one browser.