@Nando Thanks for reaching out! Happy to help here.
In Descope, email (and email verification) on first SSO login depends on the IdP attribute mapping. If the IdP isn’t sending an email claim, or if it’s not mapped correctly in the SSO configuration, the user will be created without email/verified email.
Can you double-check that your IdP is sending an email attribute and that it’s mapped to the Email field in Descope’s SSO setup? If you’re using Azure AD or Okta, the email often comes in under a specific claim name and needs to be mapped explicitly.
If you’d like, feel free to send a screenshot of your SSO attribute mapping (and the IdP claims), and we can help you spot what’s missing.
Also, if you could send a screenshot or example SAML assertion that would be helpful.