I'm trying to reconcile the following recommendation with the fact that there currently seems to be no way to selectively configure SAML SSO by Profile:
We don’t recommend enabling SSO for Salesforce admins, in case there’s an outage or other problem with your org’s SSO implementation. Instead, we recommend that admins log in directly to Salesforce using multi-factor authentication (MFA). (source)
While there is a "Is Single Sign-On Enabled" setting for User profiles, this apparently relates to delegated authentication, not SAML SSO.
I'm aware that it's possible to use a URL parameter to enable password login, even when password login is disabled in MyDomain. I'm glad this option exists, but it seems to undermine what Salesforce's upcoming MFA requirement seeks to accomplish.
Researching this topic is a bit of a challenge because there's often not a clear distinction made between SAML SSO, delegated authentication, and SSO with Salesforce's MFA. The only reference I've found that implies SAML SSO can be selectively enforced simply notes the following:
To turn it off for a portion of users is fairly challenging. (source)
I'd like to confirm that there is currently no way to selectively enforce SAML SSO at the profile or user level.