Which two things should be done to ensure end users can only use single sign-on (SSO) to login in to Salesforce? Choose 2 answers

Which two things should be done to ensure end users can only use single sign-on (SSO) to login in to Salesforce? Choose 2 answers
A . Enable My Domain and select "Prevent login from https://login.salesforce.com".
B . Request Salesforce Support to enable delegated authentication.
C . Once SSO is enabled, users are only able to login using Salesforce credentials.
D . Assign user "is Single Sign-on Enabled" permission via profile or permission set.

Answer: A,D