Brand expression (sign-in page appearance, email visuals) is suitable for per-application customization; the identity and security foundation should remain unified.