That's more or less it.

For example, I've got somewhere around 700 users. If we don't have SSO (SAML preferred, oauth as a fall back, and good whiskey is required for ldap/ad) whatever your attempting to buy won't pass review. Now Timmy the sales drone knows that, and so does their leadership - hence the SSO tax.