Can anyone suggest a controlled approach to migrate our SDP authentication away from NTLM SSO?

We already have Azure AD prepared for SDP to use as an IDP. The most obvious next step is a complete cutover, which is not ideal with 800+ users.

We'd like to test that the IDP functionality actually works before cutting over. Any ideas on how to test the new authentication method with a handful of users?