My company goes the split services way and all logins are federated through okta, or if they don't support SSO, the logins are synced to LDAP (which in turn is synced with Okta). IT has to do a one time setup when adopting new services and then it's good to go for years.

But yes, it's a complicated setup, and I didn't even mention the Sailpoint integration to manage which users have access to which services. But there are over a hundred different services in our ecosystem and all are synced up to a single login per user, so it's definitely possible.