Example: Say an enterprise "ExampleEnterprise" has - internal.outlook.com, internal.sage.com, internal.pipeline.com and they are all internal, how do ExampleEnterprise would go and build seamless SSO on these?

As for as i understood ExampleEnterprise wouldn't register those sites on github or serve well-known/ metadata files on those domains rather they get to access enterprise level policy where they can configure the above URLs as associated sites under a first party set and everything works?

Thank you for the help in advance.