The recommendation is ignoring the reality of the world. How can developers handle authentication when authentication is not allowed on their company domains?

The recommendation is ignoring the reality of the world. How can developers handle authentication when authentication is not allowed on their company domains? Measures like filtering/whitelisting are always pushed back in my experience because it's legitimately preventing developers to support authentication.