I'm planning on adding instructions on setting up Okta SAML for fleet to the SSO docs, but want to first confirm that Fleet only supports SP-initiated SAML login and not IDP-initiated login.

That is correct.