I don't know all the details, but for SSO think about how you log into GMail. They enforce U2F and I'm pretty sure special certs get deployed to client machines.

As for machine administration, it's ChromeOS, what needs administration? Just keep logs of auth and app usage on the server side and you have all the logs you ever need to track down bad behavior. Nothing can be installed on a majority of client systems, and nothing needs to be installed, as it should be.