We use enbw own centralized Identity & Access Mgmt System using a Keycloak server as the identity provider, which is capable of automatically synchronizing users from main enbw/o365 and their roles from Savvy. In addition it is possible to add roles manually via IDM own UI, which then get automatically synchronized to identity provider.
Using enbw Identity & Access Mgmt we also ensure user and role lifecycle.