The other big thing is lots of saas companies don't implement multiple users per company initially, so you end up with a google doc with all the shared passwords of things like analytics/ads providers. This way you get a unique login, acls, etc by hiding the shared password inside onelogin

I've used these, but refused to put more important things like aws in there.