Based upon Apple Developers configuration framework: https://developer.apple.com/library/archive/samplecode/sc2279/Introduction/Intro.html
Can basic settings of Require SSO and propagate the organization's account name in the settings payload.

Example:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>LoginOption</key>
<string>sso</string>
<key>AccountName</key>
<string>companyaccount</strubg>
</dict>
</plist>