I don't know what it's like on Xbox, but I recently had to set up an identity provider in AWS that delegates to Azure AD, and Microsoft's documentation claims t

I don't know what it's like on Xbox, but I recently had to set up an identity provider in AWS that delegates to Azure AD, and Microsoft's documentation claims the integration is single-click with IAM Identity Center to generate the SAML config using an app tile available in their app catalog in Azure. This may be true in general, but it's not true for their FedRamp environment, and the devs with access to Azure, which I did not have, couldn't figure out how to do it manually. This customer obviously had a paid account in Azure, along with plenty of other enterprise IT services purchased from Microsoft, and it still took four weeks for Microsoft to finally get them a scheduled meeting with a solutions architect who knew how to do what they needed to do.