Enterprise SSO
Use the current SAML flow without changing the production SSO path.
Local access
Use a SAPA-managed account created by an authentication administrator.