I've seen places appear to use Google as an IDP but the reality was that Okta or Active Directory held the actual corporate identity management with a few selec

I've seen places appear to use Google as an IDP but the reality was that Okta or Active Directory held the actual corporate identity management with a few select developer tooling hooked into a secondary domain hosted in Google Workspace. Those companies appear on the surface to be following best practices but leaver are constantly forgotten about because corporate IT will remove them from AD and nobody will tell "DevOps" (or whoever owns Google Workspace) to remove those same leavers as well. Which obviously then creates significant risk. Often these places end up with two domains because working with Corporate IT is painful for agile development scrums. But the issue there is company culture, not the IDP. I'm yet to see anyone use Google Workspace effectively at enterprise scale (startups, sure. But startups optimise for speed of development, not long term scalability).