Previously it was possible for the only owner with SSO access to leave
the group. This would leave the group without any owners that could
access the group or turn off SSO Enforcement, as none of them would pass
the SSO Enforcement to gain access. Additionally Group Managed Accounts
means that attempting to re-join the group would result in a sign up
form being presented and requiring a different email, preventing a the
owner from re-gaining access.