What is the recommended approach to SSO - at Domain/IDCS level, or in ERP Instance directly

Summary: What are the Pros and Cons of using IAMS Domain level SSO vs Environment (Security Console/Single Sign-on), and whicih is recommended?

Content (required):

Our ERP tenancy has recently migrated from IDCS to IAMS. We have just provisioned two new instances for the next phase of our project - and this has resulted in two new domains in IAMS. We are about to set up SSO against our Microsoft Azure AD subscription, and are looking for feedback on the options. We have used SSO from within the ERP environment itself for the previous environments, nd this works well, but has a few limitations, especially around managing Supplier Portal access and the like. Has anyone used the IDCS/Domain level SSO, and