GP wants not to self host yet wants to have the control. Though what you described is just a regular federated identity workflow, except autodiscovery through

GP wants not to self host yet wants to have the control. Though what you described is just a regular federated identity workflow, except autodiscovery through DNS (though that is already a thing for some)