We use Okta internally.

As much as I hated it at first, we don't choose any provider that doesn't support single sign on and multiple users.

You can choose a password policy that is different (stricter) than the downstream services.

One more good thing about it is that you have all of your services in one place and you know when you need to change password on one of them or all of them. You can do it with a nice dashboard.

This made managing access a much nicer experience for us and I can imagine will minimize things like that from happening.