The easiest approach would be to have moderators log in via the same SSO provider site as students are using. Is there something that prevents you from configuring things in that way? I’m guessing that it’s not possible for moderators to create accounts on the SSO provider site, but maybe that’s not the case.