In order to generate or regenerate an API key, you must have a local password. For accounts that use SCIM for account creation, and do not allow sign in via anything but SSO, this presents a problem since users do not have, and can never use, a local password for auth. Users are forced to go through the "Forgot Password" path, set up a password, store it, and use it when managing their API key. This was recently found to be problematic for service accounts used by scripts, as they did not have mailboxes to be sent the "Forgot Password" link as well. Allowing users to manage their API key by confirming via their SSO method like Okta or Azure would eliminate that local password need.