SSL-VPN SAML SSO with Azure AD

Hello,

I have a FortiGate 60E appliance on which I am trying to enable SAML sign-on for the SSL-VPN portal. I have followed the steps in Fortinet's guide, as well as verifying everything using Microsoft's guide. SAML SSO does technically work, but it authenticates everyone as the "azure" user. Here are my configs:

FortiGate Side:

FW (saml) # show full config user saml     edit "azure"         set cert "{CERT}"         set entity-id "https://{FQDN}:8443/remote/saml/metadata";         set single-sign-on-url "https://{FQDN}:8443/remote/saml/login";         set single-logout-url "https://{FQDN}:8443/remote/saml/logout";         set idp-entity-id "https://sts.windows.net/{GUID}";         set idp-single-sign-on-url "https://login.microsoftonline.com/{GUID}/saml2";         set idp-single-logout-url "https://login.microsoftonline.com/{GUID}/saml2";         set idp-cert "REMOTE_Cert_1"         set user-name "username"         set group-name "group"     next end

 edit "AAD-{Group}"         set group-type firewall         set authtimeout 0         set auth-concurrent-override disable         set http-digest-realm ''         set member "azure"         config match             edit 1                 set server-name "azure"                 set group-name "{GUID}"             next         end     next

On the Azure side:

Basic SAML Settings

Identifier (Entity ID) - https://{FQDN}:8443/remote/saml/metadata Reply URL (Assertion Consumer Service URL) - https://{FQDN}:8443/remote/saml/login Sign on URL - https://{FQDN}:8443/remote/saml/login Logout Url (Optional) - https://{FQDN}:8443/remote/saml/logout

Attributes and Claims

givenname user.givenname surname user.surname emailaddress user.mail name user.userprincipalname username user.userprincipalname group user.groups name user.userprincipalname  Unique User Identifier user.userprincipalname

Again, the whole SSO process works, but the user is just being signed in to the FortiGate as "azure". Through some debug commands (as well as a browser plugin that captures SAML conversations) I can see that the user's identification is being passed to the FortiGate by Azure. Any help here is appreciated.