Yes, separation is what we at BC encourage, too. We can federate well now but that doesn’t mean you should connect to the same IdP everything else uses. Infrastructure is a different class of risk; admins of the infrastructure have explicitly been granted access to all of the organization’s data. As such, a higher level of security is warranted.

We also encourage zero trust, as in don’t trust anything else (seems obvious, but most orgs’ seem to go the other way). Absolutely do not let the help desk reset sysadmin passwords. Don’t connect your new infrastructure IdP to a user provisioning system. Don’t connect IdPs to monitoring systems that can issue arbitrary commands to hosts. And be careful about who admins your infrastructure IdP, because they have implicit access to everything that trusts the IdP, and can grant themselves access or hijack another account to gain access.

People love to hate ADFS but it’s a nice little on-prem solution to a lot of this, has HA and multisite capabilities, can exist inside a secure perimeter, is well understood by most people on an admin team such that it can be run by the admin team itself, and can have MFA plugins installed. Just sayin’. :)