Single sign-on is required here, so a password only works for the break-glass account - the one this deployment was set up with. It is the way back in if the identity provider is unreachable.