anyone have experience scripting around the the Single Sign-On Only role? We utilize this role to allow customers to access a “billing center” where they can apply payments to open Invoices. There’s a User Event behind this that is supposed to call out to an external system once the Invoice is paid in full. It fires for internal roles, but does not seem to work for SSO Only. Are there limitations to how this role works?

Afaik SSO Only shouldn't affect how a UE behaves as it is just an authentication restriction. Have you tried testing with a simple UE on an SSO role and see if same issue occurs? If yes you should file this as a bug, unless SuiteAnswers state otherwise.

We have not specifically tried with other UE scripts, but will give that a go and see how it works. Thank you for the suggestion!

Also try to check the deployment settings of the script, it might not be released for the SSO only role