Best practice- Identity Domains in Oracle Cloud EPM – Single default domain vs multiple domains

Hi Experts,

We are currently designing the security architecture for our Oracle Cloud EPM landscape and would like guidance on identity domain strategy.

Our environment includes multiple EPM modules (e.g., Planning/EPBCS, FCCS, ARCS), and we are evaluating the following options:

Use the default identity domain for all EPM instances and manage access segregation using groups and roles

Create separate identity domains for each application (for example, one domain for Planning, another for FCCS, another for ARCS)

From an Oracle best practice and long-term maintenance perspective, which approach is recommended?

Specifically, we would like to understand impacts on:

SSO and user experience