We are running into an issue where some of our guest users (vendors) can't access our tenant via SSO. SSO works flawless for a handful of our vendors that do not use AzureAD and their guest accounts show up as username#EXT#@domain.onmicrosoft.com in the SAML sign in logs. However, the accounts that do have Microsoft accounts and use Meraki at their company, show up as their normal username@domain.com address and will get the login error of "Found existing non-saml user with email username@domain.com". Even though they are not an admin in my tenant, I assume that error is somehow seeing their email in their tenant.
What can I change in my SAML config in Azure Apps to prevent this from happening? Setting the user up as a non-saml administrator is not an option in this case.
Current configuration:
This is a very common issue. I tend to fix it by changing the "username" attribute to "user.displayname".
This is a very common issue. I tend to fix it by changing the "username" attribute to "user.displayname".
From memory, this happens when the SAML roles are not correctly mapped to Meraki roles.
Go to Organization/Administrators/SAML Login History. Look for an error there.
