Why does SSO login fail with an email claim error?
This usually means Azure isn’t sending the email claim in the exact form Testomat.io expects. Work through these four checks.
1. Check the claim URI
Section titled “1. Check the claim URI”In Azure AD, go to Enterprise Application, then Attributes & Claims. The email claim must use exactly this URI:
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
Azure often sends …/claims/email instead, and that mismatch blocks login.
2. Remove Azure’s default attributes
Section titled “2. Remove Azure’s default attributes”Delete the default claims before adding your own. If you leave them in place, Azure can send conflicting values even when your new claim is correct.
Your mapping should be:
…/claims/emailaddress→email…/claims/name→name…/claims/givenname→first_name…/claims/surname→last_name
3. Check user.mail against user.userprincipalname
Section titled “3. Check user.mail against user.userprincipalname”Some Azure accounts have an empty mail attribute, so user.mail returns nothing. If that’s the case, set the email claim’s value to user.userprincipalname instead.
4. Verify the company domain
Section titled “4. Verify the company domain”In your Testomat.io SSO settings, the Company domain must match your users’ email domain, for example mycompany.com. SSO uses it to resolve the connection.
Still locked out?
Section titled “Still locked out?”If sign-in still fails, email support@testomat.io and include your SAML response claims. That lets the team compare what Azure is sending against what’s expected, and get your access restored.