## Is your feature request related to a problem?

We manage around 20 3rd party tools that our internal users can log into using G Suite (part of your enterprise / scale offering). When a user leaves, we need to disable their account. Currently we need to do this in G Suite and then any of the 3rd party tools where password login is still possible.

## Describe the solution you'd like

When a user leaves, we disable their account in G Suite and their account in PostHog becomes disabled too. Essentially, the ability to restrict specific users in PostHog to only be able to login via SSO (defaulting to this setting).

## Describe alternatives you've considered

Manually removing their account, and being the enemy of our IT manager.

## Additional context



#### *Thank you* for your feature request – we love each and every one!

ee/api/test/test_authentication.py
"""
        SAML has automatic provisioning for any user who logs in, even if the domain whitelist does not match.
        """
        self.client.logout()
        organization = Organization.objects.create(name="Base Org")
        team = Team.objects.create(organization=organization, name="Base Team")
        Organization.objects.create(name="Red Herring", domain_whitelist=["differentdomain.com"])  
        with self.settings(**MOCK_SETTINGS):
            response = self.client.get("/login/saml/?idp=posthog_custom")
        self.assertEqual(response.status_code, status.HTTP_302_FOUND)
        _session = self.client.session
        _session.update(
            {"saml_state": "ONELOGIN_87856a50b5490e643b1ebef9cb5bf6e78225a3c6",}
        )
        _session.save()
        f = open(os.path.join(CURRENT_FOLDER, "fixtures/saml_login_response"), "r")
        saml_response = f.read()
        f.close()
        user_count = User.objects.count()
        with self.settings(**MOCK_SETTINGS):
            response = self.client.post(
                "/complete/saml/",
                {"SAMLResponse": saml_response, "RelayState": "posthog_custom",},
                format="multipart",
                follow=True,
            )
        self.assertEqual(response.status_code, status.HTTP_200_OK)  
        self.assertRedirects(response, "/")