Tasked with moving our Atlassian Cloud tenant under Okta SSO. I understand there's a Guard piece we need, but I also think there's a limit on all users have to be managed users, which means all domains of users have to be included. And other stuff. Anyone done this? Where are the hidden gotchas?