Currently, if an account has SSO enabled and a new user logs in they will be auto provisioned in the account.
This causes issues with Premium subscriptions as they cannot have unpaid users in the account. The result is that the new user is provisioned and bumps one of the paid users to inactive status, effectively consuming their license.
This is less common on Enterprise or Enterprise+ subscriptions due to unlimited reviewer/viewer/none users. However, if the Enterprise or Enterprise+ account is setup so new users are provisioned with paid seats they could also end up bumping existing paid users from the account.
Thank you for the idea. Given the low volume of support for this idea, we do not have plans to make updates in this area at this time. It is currently possible to specific user roles via SSO, which should help Enterprise accounts avoid assigning paid seats unexpectedly. We hope that helps!
In addition to the issue described in the Idea, it also causes extra administrative overhead even if extra seats are available. I need to keep the auto-created SSO users pruned when I want to add a "real" new user.