We switched to Azure AD for SSO (already had it for M365 regardless). We found more apps had OIDC support on AAD for the ones we used (40+, so admittedly small).

Plus, Microsoft doesn't charge anything for MFA, unlike the $6/user that Okta was going to charge.