Use case: We have enabled SSO, but if managers invite people within the domain (which they will do because it appears they can) the new user wont be able to login because they are not in the approved AD group which only can be done my an IT administrator. Anticipating this scenario will create confusion and frustration for our managers and members.