Thanks for the detailed post. I've been having a lot of trouble with this particular set up. The really tricky part is that about 30% of the time, I can connect to the VPN using Google SAML auth, but the rest of the time I get "app_not_configured_for_user" In the logs on the Google side, the times it failed I can see the SAML request came in, but there is no "Application name" in the log. It's like it was an incomplete request? The TEST SAML LOGIN button seems to always work, so I suspect it's something in the AnyConnect Client? When I tested this with AzureAD, it opens the AnyConnect browser helper app (acwebhelper.exe) each time, and I have to log in each time. When I switch the XML in the Maraki config back to Google, it never asks me to log back in, it's like it's saved the credentials somewhere and I can't clear the cache?   Using AnyConnect Client v 4.10.05085   I'm hoping someone might be able to shed some light on what's going on? ... View more