Not only password policies, but authentication policies as a while. For example, the location from where you may authenticate, or the times, the IP address ranges, the device you're using, and so on.

It is also important for user account lifecycle. If a user joins or leaves the company, IT need to be able to grant or revoke access without having to go on an individual account hunt.

If a service does not offer SSO (or a good implementation of it, because most services seem to follow some YouTube guide in how to add SSO - it's that bad) our policies forbid us from buying it.