Hi,
I think there might be some problem with the Claims. You can use SAML Tracer plugin for chrome and edge and track what is going wrong.
Did you set context classes? That in combination with using MFA on their end could be cause. I always ask if they have an MFA setup on their end and then I set no context classes on my end because it is then all up to the IdP.
Regards,
Ronald
No, we use one instance. I discovered that there are more apps with this problem, also outside the organisation with another IdP.