As far as my understanding goes I can set some general settings in Users -> Resource Policies -> SSO -> General.
So I set a label (e.g. "owa"), a domain and credential type "variable" so I can use username and password again. But somehow it does not work. I've also tried credential type "system" and "static".