SAML user name for SaaS is prefixed with sts.windows.net

Question

My IT department is trying to configure an Azure AD certificate to enable SSO for a SaaS service. However, when user's log in for the first time, their user name is of the form:
https://sts.windows.net/######-####-####-####-#########/:login[@](/users/na/?userId=b86545af-0000-0003-0000-000000000000).com

How does one configure AD so that SAML gets the correct user name, e.g. First Last?

Answer 1

@Ed Jobe
Thank you for your post and I apologize for the delayed response!

From your issue, I understand that when a user logs in for the first time, their username is in the form of - https://sts.windows.net/######-####-####-####-#########/:login@company.com, and you'd like to configure Azure AD so that SAML gets the correct username - i.e. First and Last Name.

• When it comes to https://sts.windows.net/######-####-####-####-#########/:login@company.com, are you able to confirm if this is your Tenant ID (Issuer)?
• Or is this the Object ID of the user signing in?
• Within the SAML Token, are you able to correctly see the user's First and Last name?

When it comes to having Azure AD get the correct names or mapping the correct values to attributes, have you looked into the AttributeStatement?

Single sign-on SAML protocol

I hope this helps!

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.