This post outlines GAT+ install instructions for domains who have SSO verification:
Install GAT+ directly from the G Suite marketplace.
To install GAT+ you must first log into your Domain as a Super Admin. GAT+ will be a default install for all accounts on the domain.
Some Super Admin accounts are not authenticated by Google but are instead verified by a third party SSO. If your domain uses a local or third-party identity manager, you may be directed to the G Suite Admin console when you try to install GAT+ and from there you need to continue the installation via the console, clicking under Apps, Marketplace Apps, ‘+’ and then searching again for GAT+.
It works best if it is installed to the root OU ‘/’ and allowed to access all sub-OUs. This is because it cross-tabulates audit details from every account to build as complete an activity database as possible. Once installed Each user can use GAT+ to audit their own drive and email files. Only super Admins can audit everyone’s files. If Super Admins wish to block ordinary users from using GAT+ they can do so in the ‘Configure GAT’ section on the GAT+ home page.