update sso docs

Author: marcklingen

pages/docs/administration/authentication-and-sso.mdx

@@ -50,12 +50,14 @@ For security reasons, Langfuse does not support switching between social logins
   }}
 />
 
-Langfuse supports **Enterprise SSO** (e.g. Okta, Azure AD, Keycloak etc.) via OIDC. Please reach out to [support](/support) to enable this feature. Existing users who signed up with an email/password or social logins are automatically migrated to the Enterprise SSO provider once it is set up.
+Langfuse supports **Enterprise SSO** (e.g. Okta, Azure AD, Keycloak etc.) via OIDC. Please reach out to [support](/support) to enable this feature.
 
-To sign in with an Enterprise SSO provider, please (1) enter your email address, and (2) press "Continue". You will be redirected to the Enterprise SSO provider to authenticate.
+Details:
+
+- **Migration:** Existing users who signed up with an email/password or social logins are automatically migrated to the Enterprise SSO provider once it is set up.
+- **Authorization:** Enterprise SSO does not automatically provision [roles](/docs/administration/rbac) for new users upon signup. Users must be invited to an organization, either through the UI (settings > members) or the [SCIM API](/docs/administration/scim-and-org-api).
+- **Signing in:** To sign in with an Enterprise SSO provider, please (1) enter your email address, and (2) press "Continue". You will be redirected to the Enterprise SSO provider to authenticate.
 
 <Frame border className="max-w-lg">
   ![SSO Sign-in Flow](/images/security/sso-signin.png)
 </Frame>
-
-Optionally, you can **enforce the use of SSO / social logins for your domain**. Please reach out to [support](/support) to enable this feature.