## Is your feature request related to a problem?

We manage around 20 3rd party tools that our internal users can log into using G Suite (part of your enterprise / scale offering). When a user leaves, we need to disable their account. Currently we need to do this in G Suite and then any of the 3rd party tools where password login is still possible.

## Describe the solution you'd like

When a user leaves, we disable their account in G Suite and their account in PostHog becomes disabled too. Essentially, the ability to restrict specific users in PostHog to only be able to login via SSO (defaulting to this setting).

## Describe alternatives you've considered

Manually removing their account, and being the enemy of our IT manager.

## Additional context



#### *Thank you* for your feature request – we love each and every one!

ee/api/test/test_authentication.py
self.assertEqual(User.objects.count(), user_count + 1)
        user = cast(User, User.objects.last())
        self.assertEqual(user.first_name, "PostHog")
        self.assertEqual(user.email, "engineering@posthog.com")
        self.assertEqual(user.organization, organization)
        self.assertEqual(user.team, team)
        self.assertEqual(user.organization_memberships.count(), 1)
        self.assertEqual(
            cast(OrganizationMembership, user.organization_memberships.first()).level,
            OrganizationMembership.Level.MEMBER,
        )
        _session = self.client.session
        self.assertEqual(_session.get("_auth_user_id"), str(user.pk))
    @freeze_time("2021-08-25T23:37:55.345Z")
    def test_can_configure_saml_assertion_attribute_names(self):
        settings = cast(Dict, copy.deepcopy(MOCK_SETTINGS))
        settings["SOCIAL_AUTH_SAML_ENABLED_IDPS"]["posthog_custom"]["attr_first_name"] = "urn:oid:2.5.4.42"
        settings["SOCIAL_AUTH_SAML_ENABLED_IDPS"]["posthog_custom"]["attr_last_name"] = "urn:oid:2.5.4.4"
        settings["SOCIAL_AUTH_SAML_ENABLED_IDPS"]["posthog_custom"]["attr_email"] = "urn:oid:0.9.2342.19200300.100.1.3"
        self.client.logout()
        self.organization.domain_whitelist = ["posthog.com"]
        self.organization.save()
        with self.settings(**settings):
            response = self.client.get("/login/saml/?idp=posthog_custom")
        self.assertEqual(response.status_code, status.HTTP_302_FOUND)
        _session = self.client.session
        _session.update(
            {"saml_state": "ONELOGIN_87856a50b5490e643b1ebef9cb5bf6e78225a3c6",}
        )