The most important factor in this decision is maintaining separation of concerns between user authentication (identity provider) and network authorization (Twingate). Since we rely on an identity authority for access, if the user--or an attacker--is unable to authenticate themselves, we can't allow a network connection to proceed, keeping the destination resources safe. This is even more important for customers using an identity provider like Okta, allowing them to continue managing all of their users centrally.