Context: when we restricted our SSO group to the licensed user list, we learned that the assignment change only applies to future logins — existing sessions stay active. The only remediation available was logging users out one by one through the pagi...