I, too, would like this feature but unfortunately it isn't a supported feature. If you want to scope and use SSO/SAML, you'll need to manually create your users and groups via the JPS. If you do go this route, make sure your usernames match the SSO username or you'll run into issues down the line.
