Do you use SSO and require group membership? And does it also assign permissions?

We use AD for SSO and it works well with the permissions assigned to the role.   The advantage here is once someone is assigned the appropriate role in AD there is no need to do any management within LogicMonitor other than tuning permissions within that role.   I would always keep a fallback username and password should there ever be any issues with your SSO integration.   

Migrating to AD Role based access control will reduce your administrative overhead once deployed.   We set up the roles on deployment and other than adding new teams we have not had to worry about anything.