A. A Heroku account is created for the employee automatically the first time they log in to Heroku via SS
B. The employee should create a new Heroku account with the exact email addresslisted in their IdP record.
C. No account creation is required, because all SSO users in a particular Enterprise Team are associated with a single Heroku account.
D. An administrator of the Enterprise Team creates the Heroku account with the exact email address listed in the employee's IdP record.
Explanation:
https://devcenterherokucom/artJcles/using-sso-services-with-heroku#end-user-account-creation-and-removal