If your SSO is on-prem (or non-SaaS) only you have access to it.

Using Okta, every random support person at Okta is a super-admin within your organization able to grant themselves access to all of your stuff.