@kyle I have used onelogin and azure sso for sandboxes to give users access to sb for UAT, but it was a administration nightmare, each refresh required setting changes in SB and in onelogin/azure. So I decided to create same roles in sb without SAML and gave test users direct password based access. Used SSO only for production.