Then you manage it once. Typically you can get rid of most of the password bullshit by adding MFA, with some exceptions. Unless you’re a DoD contractor or handling taxpayer data the came from the IRS on behalf of a client, MFA should meet or exceed compliance requirements.
Edit: It has been posted 7 times in the last year.
Totally hear you re the cost, it depends on the risks you face. I’m in a bigger enterprise, but for me, no SSO, it is out in 95% of situations. In the exceptions we have, we require vaulted passwords.
A breach would put me out of business, and identity is a key security control for many risks.
And then there are customers who have requirements about passwords, even though they are only going to be using an IDP anyway. It is probably because they have the same standard list of requirements that they give to everyone, and probably was copied from somewhere else, and you can usually contest it. But it is still a waste of time for everyone.