Probably the department's fault for not using (presumably) Entra Conditional Access to restrict SSO to corporate devices / corporate subnets.
This is why if you're building a product, please give SSO for free (see sso.tax) - you shift responsibility, requirements and posture to the tenant's IdP.
This is why if you're building a product, please give SSO for free (see sso.tax) - you shift responsibility, requirements and posture to the tenant's IdP.