What breaks

A six-step diagnostic for "nobody can sign in after the SSO change", then eight cases. Activating an untested configuration and locking everyone out — recoverable through support, slowly and visibly, and the failure this module exists to prevent. Username mismatch, the most common single cause. Web working and Excel not. Automation failing silently overnight. A sign-out that does not sign out. Users not told and support overwhelmed, which is communication rather than configuration and entirely predictable. And the provider being down with nobody aware the administrator route exists as a contingency.