GP was probably thinking of Azure AD / Entra as the "SSO tax".