I used ssh_config's `Match` recently to route only okta-managed servers via their auth proxy command. That was quite powerful.