Sounds exciting!
While saml2 is a good option for providing SSO, what you really need "first" is a single identity provider for all those instances - typically this means using something like Azure AD or in some cases Google as your main authentation provider - once you have that sorted, you'd use either the built-in Oauth Moodle functionality to connect to that system or if you need something slightly different the auth_saml2 plugin can be a good option.
There are some options like using MNET or
LTI to connect the Moodle systems, but they are a lot more fragile and often won't perform in the way you want with such a large number of sites (and MNET is basically deprecated too.)
You might find that all the users are already using Microsoft or Gmail for their email handling anyway so just connecting them all to MS/Google Oauth endpoints might be all you need to do. see:/
https://docs.moodle.org/311/en/OAuth_2_authentication
In terms of your analytic needs, I'd reccomend you try the following.
1) install
https://moodle.org/plugins/logstore_xapi in all your plugins, and connect them all to an instance of learning locker; for your initial trial I'd reccomend you just pay learning locker to
host it to start with and then look later at hosting it yourself if this works well. This scenario (multiple sources of learning data) is where the Experiance api/Tin can really shines. Keep in mind that this is only exporting "logs" though - so things like "what courses is the student enrolled in now" is not easy to answer from the external report source.,
2) Reach out to Intelliboard (Official Moodle integration partner) and discuss with them the multi-tenancy reporting they can do - they have a really slick out of the box reporting engine that might provide a large number of the reports that the client is already thinking about (as well as a bunch they didn't know they would be interested in.)
3) If you want to go with something bespoke - I've seen a lot of organisations use Microsoft's Power BI and just directly connect/ingest data from all the Moodle
database systems - quite a bit more work involved here, but it becomes a pretty flexible reporting tool.
4) If you're looking for something open source - we've been playing a lot with Metabase here at Catalyst recently (
https://www.metabase.com/) we're using it for tracking higher level information about all the moodle sites in our fleet (version updates / plugin versions) - but from an ISP level rather than from the level of a researcher/client but it could also potentially be adapted for some client style reporting. (but likely a lot more work than option 1/2 above.)
