omneity basically hit it on the head.

The core of SCIM/SAML is relatively simple, but there are tons of different ways companies can configure things.

* Younger companies tend to use a "modern" identity provider, Okta, Google Workplace, etc. However, the owner of SSO system doesn't tend to be an SSO expert. These setups normally work "out of the box", but require a bit more generic guidance since the person setting it up only deals with SSO occasionally.

* Older companies have the internal expertise, but often use legacy configurations. Many time, this is just a matter of figuring out what the two different system call various fields. However, the range of errors can be huge, so you have to explore a bunch of stuff.

Not the GP, but from my personal experience and exposure to Kerberos and SAML, most customers have a very custom SSO setup, permissioning can be hell (especially if the company did it a long time ago, and they didn't onboard a new SSO-friendly vendor in a long time), and all in all any interaction with the SSO system typically requires long back and forths with IT and other kinds of red tape.