In the update application api documentation allowed_idps is marked as optional parameter.
But if we make api call without specifying allowed_idps, allowed_idps for the application gets reset and all the available idps in account gets enabled for the application.
https://api.cloudflare.com/#access-applications-update-access-application