World of EUC

Ray when you use FAS the gateway uses whatever saml claim you defined to match a user into your onprem ad. So you should check for the problem users what the claim looks like.  Normally its a upn but could be samacctname. 

Have seen similar happen in Edge where either the browser profile or a tab e.g. Sharepoint online has already authenticated to Azure and received an auth token, then even if signing into the Gateways Azure IDP with a different ID it will give an error back as it tries to reused the existing accounts auth token instead of generating a new one for the new logon. Never figured it out as was easier to just get the users to open a new guest browser instance (or one with the profile for the other account) when wanting to login with different creds.

We figured it out, I had to add another profile in Edge for the account they needed. Then it worked as normal. Thank you guys

By Adding another profile in edge, when it checks it see the other account, when you select it, it then honors it and allows the UPN to be passed through. Assumeing the UPN match the conditional access. But that was what we found out. Then Workspace app, workded as well to pull in that user application in. Very strange setup.