On the SSO page, in the Domains field it’s possible to input non-CSV formatted text.
If you do this, SSO will function but common login (via email+password) will not be disabled, even if the “Disable common login“ button is checked.
I noticed this by inputting domains with line breaks instead of commas.