We decided a good strategy was to have the IdP do a soft failover to Ignition’s default provider and have the Administrator in there so that if anything happens the IdP we can still get in to fix it. It works.
See configuration details in the bottom of the post below.