It'd be great to be able to restrict the user's access to read only so that they cannot make changes to another account via SSO access.