Not implemented yet. These settings are stored so a site can be configured ahead of the feature landing, but nothing consumes them today: there is no SAML login route, and no assertion is accepted. Sign-in is local accounts only, whatever is set here.
When it ships, users will sign in through your organization's identity provider (Azure AD, Okta, etc.), with local login available as a fallback.
The four legacy collector routes (/api/collector/pc,
/apps, /heartbeat, /bulk) name
the PC they write in the request body, so the shared collector key is
an any-host write key on them: whoever holds it can rewrite the
logged-in user, last boot time, serial number and installed apps of
any hostname. A collector-scoped managed token is unaffected.
Report-AssetToShopDB.ps1 and
Report-PrintersToShopDB.ps1 reporting through those
routes until they are moved to per-PC credentials, along with
anything else still calling them with the shared key. Every
shared-key call is logged as "Legacy collector route used with the
shared key" whether this is on or off - read those warnings for a
while first, or turning it on is a guess. On the shipped IIS deploy
that line names the route but not the caller: the X-Forwarded-For
rewrite rule in web.config ships disabled, so every request reaches
the app from 127.0.0.1. Count the routes, not the addresses, unless
that rule is on. The shipped reporters that post to
/api/collector/computers and
/api/collector/printers are not affected. This should
follow the move to per-PC credentials, not lead it.
Manage local user accounts and roles. Local accounts work alongside SAML when both are enabled.