Administrators can enable\disable SSO but they should be able to remove the SSO option in the login screen