Which works if every single tool you use is hooked up to your one central authentication provider. Then there are tools that aren't. Entire acquired company's systems that aren't (yet). Parts of those companies nobody know exist and thus aren't ever migrated over etc.