@sam i don't believe it can in the cleanest manner, SSO allows an external source to send a token rather than a password, so it enhances security but also prevents the user from needing to change their password. As soon as the user connected to SSO's password changes in NetSuite, the SSO token needs to be renewed