Hi @Isla we are currently looking into this more closely and will update this topic. It appears you were correct that the setting needs to be disabled then re-enabled after the admin makes the change. I’m sorry for the misunderstanding with this - we do usually have admin overrides on most settings like this, but sometimes there may be legitimate reasons not to that we need to consider.
SSO is Single Sign On, which may be one of the reasons that setting is configured the way it is.