Requires organization administration and a mapped local workspace. The SSO connection of the workspace must use the directory user model (the directory-user-management flag on one of its workspaces) and list the email as a directory user, or the answer is 400 not_a_directory_user. When the person has logged in already, this grants the role now and claims a seat, and fails when the person is a member already or no seat is free. Otherwise it records a pending assignment, or changes the role of the one that exists, with no seat and no email. The first login resolves it.