Offline sso identity provider

After decades working in cloud and just defaulting to cloud solutions I’m stumped with a unique challenge. We have various customer end points which have various apps provided by us which need sso but the machines (and entire site) are only rarely online (due to good reasons), we also have a suite of tools in the cloud. it would be desirable that someone could be on cloud change password and access both offline sso with old password and cloud assets …

apps challenge cloud customer cybersecurity end good identity identity provider machines solutions sso tools working