Many companies use SSO like okta/onelogin to mange access to their important portals or use their own sso like "sso. company. com" for the same reason, as a bug bounty hunter your aim to find extra assets for the target specially ones no one found.

-------------------------------------------------------------
We can use the SSO host itself to find :
1- Other domains for the company which opens a new entry for the attacker
2- Third party portals where company using a cloud service from other vendor like as example (company. service-now .com)
-------------------------------------------------------------

Many third party portals can have misconfigurations and endpoints that are not protected by the SSO in proper way, good file/folder bruteforcing can get you to some cool places, or there might be already a known bug in product itself, same goes for target own portals
Lets take "indeed" BB program as example using shodan,RISKIQ “Host Pairs Tab”, and uriscan
https://nitter.snopyta.org/Th3G3nt3lman/status/1386274249493581827
