anchor.diff:  
   When setting up SSO with a SAML provider, setup happens on two sides: Buildkite and your identity provider. Before you can complete your identity provider's setup, you'll need to get your 'Issuer URL' from Buildkite. Using this URL, you can set up Buildkite as an application in your identity provider. Next you'll send your identity provider's information to Buildkite, and our team will complete your SSO setup.
   
  -For more information on the SAML user attributes Buildkite supports, see the [Custom SAML Guide](/docs/integrations/sso/custom-saml#saml-user-attributes). 
  +For more information on the SAML user attributes Buildkite supports, see the [Custom SAML Guide](/docs/integrations/sso/custom-saml#saml-user-attributes).
   
   If you'd prefer a self-service setup, you can complete the Buildkite side yourself using the Buildkite GraphQL explorer. Check out our guide to [Setting up SSO with GraphQL](/docs/integrations/sso/sso-setup-with-graphql).
   
   ## Frequently Asked Questions
   
   ### Can some people in the organization use SSO and others not?
  -Yes, team maintainers can select whether a user is 'required' to use SSO or whether it is 'optional'. This setting can be found in the team settings. 
  +Yes, team maintainers can select whether a user is 'required' to use SSO or whether it is 'optional'. This setting can be found in the team settings.
   
   ### What happens if a person leaves our company?
  -You will need to manually remove them from your Buildkite organization. This will not affect access to the user's personal account or any other organizations they are a member of.  
  +You will need to manually remove them from your Buildkite organization. This will not affect access to the user's personal account or any other organizations they are a member of.
   
   ### Can we enable SSO on multiple domains for one organization?
   Yes, by adding multiple identity providers. Each provider supports only one domain, but you can enable as many different identity providers for your organization as you need.
  
positive.code: Yes, within Australian business hours. 
  
  ### Is there a self-service SSO enablement option?
  Yes, if you're comfortable using GraphQL, you can enable SSO yourself for your organization. Check out our GraphQL SSO guide. 
  
  ### Does enabling SSO affect billing?
  No, enabling SSO will not affect how much you are billed. However, whenever a new user signs in to Buildkite using SSO, they will be added to your organization as if you had invited them.
  
  ### Can I sync my identity provider's groups with my Buildkite teams?
  Yes, if you're using a SAML identity provider. OAuth providers such as Google G Suite do not support groups. 
  
  
negative.code: 
  Buildkite organizations can perform SSO using any identity provider that supports SAML 2.0. OAuth using Google G Suite or Github is also supported.
  
  Buildkite SSO Guides help you to get SSO set up with popular providers, and a Custom SAML provider guide is available for all other identity providers.
  
  ## How does SSO work with accounts and organizations?
  
  SSO is an organization-level option, and can be enabled by an organization admin for one domain per organization.
  
  If an organization that you're a member of enables SSO, it will not affect your personal Buildkite account login details. When you access pipelines or anything owned by the organization, you'll be directed through their chosen provider's SSO authentication flow.
  
  To access an organization's content using SSO, you'll need your organization's SSO URL.
  
  Team maintainers will no longer need to invite users to join their organization, anyone who is able to authenticate with the identity provider can access the organization's content.
  
  