Restrict users who logged in via Single Sign-On (SSO) from creating a local password or linking additional SSO providers in their account settings. Account authentication methods should be managed solely through their primary SSO identity provider.