A federated domain signs in properly when accessing powerapps dashboard abut fails when direct application play URL

Question

I have a federated domain that is federated to an external IDP Ping using SAML protocol, The NameID parameter sends an email address in a different domain which I mapped to an EntraID user using the immutable id parameter. The external IDP is configured to send SAML assertion to https://login.microsoftonline.com/login.srf.

Case 1) Try to access https://apps.powerapps.com dashboard,the application redirects to the external IDP and after authentication is successful, sends post the SAML Response back to the ACS URL https://login.microsoftonline.com/login.srf. I have the PowerApps dashboard shows up with authenticated user and email correctly, Now I can access the application https://make.powerapps.com/play/e/......... from the dashboard. This case functions correctly.

Case 2) When trying to access the application URL directly something like https://make.powerapps.com/play/e/........., the application rediercts to the external IDP and after authentication is successful, sends post the SAML Response back to the ACS url https://login.microsoftonline.com/login.srf. At this point the authentication fails with error

AADSTS5000819: SAML Assertion is invalid. Email address claim is missing or does not match domain from an external realm.

The

Note: There are three domains at play here and they are all different from each other.

1. Federated domain, 2. The IDP location domain, 3. Email address Domain