Use an explicitly linked external identity. Local account protections remain required.
No upstream providers are configured.
Use local sign-in