Added per-provider SSO enforcement: users on an enforced domain must sign in through their identity provider instead of a password or social login. Customers also get one static SAML metadata URL for IdP setup.