For delivering strict network access controls, a clear audit trail at multiple points, and (at a guess) the usage of very temporary credentials to actually log

For delivering strict network access controls, a clear audit trail at multiple points, and (at a guess) the usage of very temporary credentials to actually log in, yes. Especially if the same infrastructure is used for other, less SaaS-centric data handling tasks or users are in places that like to mandate access to geo-local data (India, China, etc.). Security measures in operational workflows are only a little bit about what the end user - you - sees. Generally they're really about delivering something less obviously visible to the user but very valuable to the business, investors, and regulators.