Disclaimer before comment: I am a certified ForgeRock Engineer and Identity Access is my passion.

I used FR at my last gig for 20k+ users with a mixture of onprem and cloud devices.  You don't get this mess that ISC2 has with their "SSO solution" their provider has implemented.  Your secure MFA token goes with you where ever you traverse in the customers domain.  It's seamless and the user experience is very smooth and professional.  It allows the user to do what they are supposed to which is to be productive.

The SSO solution here is quirky at best.