Currently SFO can be enabled for the entire IdP, or for specific SPs.
I would like to enable it for a subset of users/groups for a specific SP first.
Is there a way to have this more fine grained control?