The Allow SSO feature should automatically allow the ClassLink IDP URL without having to separately whitelist them in the Classroom rules.

What's the point of the feature if it doesn't not actually allow the SSO to function?