{"before":{"protocol":"saml","label":null,"capturedAt":"2026-10-04T11:31:06.486Z","receivedAt":"2026-10-04T11:27:39.027Z","flow":"SP-initiated","subject":"Lee Gov","subjectId":"BMdsZMIDdSWzT_fxhRdyGP-wA3lQCTOdwY_GeoJDfwA","nameIdFormat":"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent","idp":{"issuer":"https://sts.windows.net/b164ba84-e972-477c-9709-7b1d0fb7d0c1/","endpoint":"https://trial-3394347.okta.com/app/trial-3394347_tfdemosaml_1/0oa18cdjgnw88XM6f698/sso/saml"}},"after":{"protocol":"saml","label":null,"capturedAt":"2026-10-04T11:37:35.627Z","receivedAt":"2026-10-04T11:37:31.730Z","flow":"SP-initiated","subject":"Lee McGovern","subjectId":"gov@tenantflex.com","nameIdFormat":"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress","idp":{"issuer":"http://www.okta.com/exk18cdjgntW2SUDH698","endpoint":"https://trial-3394347.okta.com/app/trial-3394347_tfdemosaml_1/exk18cdjgntW2SUDH698/sso/saml"}},"protocol":"saml","rows":[{"key":"subject","label":"Subject","note":"The NameID is whatever the IdP is configured to mint, and a different IdP mints a different one — or the same value in a different NameID format. Do not match existing accounts on it unless the old and new values agree.","status":"differ","before":{"name":"NameID","raw":"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent","showRaw":true,"values":["BMdsZMIDdSWzT_fxhRdyGP-wA3lQCTOdwY_GeoJDfwA"],"origin":"subject","conflict":null},"after":{"name":"NameID","raw":"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress","showRaw":true,"values":["gov@tenantflex.com"],"origin":"subject","conflict":null}},{"key":"email","label":"Email","note":"Preferred address. Not guaranteed unique and not necessarily verified.","status":"differ","before":{"name":"email","raw":"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress","showRaw":true,"values":["govvy9@gmail.com"],"origin":"assertion","conflict":null},"after":{"name":"email","raw":"email","showRaw":false,"values":["gov@tenantflex.com"],"origin":"assertion","conflict":null}},{"key":"displayName","label":"Display name","note":"Full name as the directory holds it.","status":"differ","before":{"name":"displayName","raw":"http://schemas.microsoft.com/identity/claims/displayname","showRaw":true,"values":["Lee Gov"],"origin":"assertion","conflict":null},"after":{"name":"displayName","raw":"displayName","showRaw":false,"values":["Lee McGovern"],"origin":"assertion","conflict":null}},{"key":"givenName","label":"Given name","note":"First name.","status":"match","before":{"name":"givenName","raw":"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname","showRaw":true,"values":["Lee"],"origin":"assertion","conflict":null},"after":{"name":"firstName","raw":"firstName","showRaw":false,"values":["Lee"],"origin":"assertion","conflict":null}},{"key":"familyName","label":"Family name","note":"Last name.","status":"match","before":{"name":"surname","raw":"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname","showRaw":true,"values":["McGovern"],"origin":"assertion","conflict":null},"after":{"name":"lastName","raw":"lastName","showRaw":false,"values":["McGovern"],"origin":"assertion","conflict":null}},{"key":"objectId","label":"Directory object ID","note":"Immutable directory identifier. Survives renames, unlike username or email.","status":"removed","before":{"name":"objectId","raw":"http://schemas.microsoft.com/identity/claims/objectidentifier","showRaw":true,"values":["6f5d385a-fde9-4a88-8233-2e990af99cb7"],"origin":"assertion","conflict":null},"after":null},{"key":"tenantId","label":"Tenant","note":"Which directory the user signed in from.","status":"removed","before":{"name":"tenantId","raw":"http://schemas.microsoft.com/identity/claims/tenantid","showRaw":true,"values":["b164ba84-e972-477c-9709-7b1d0fb7d0c1"],"origin":"assertion","conflict":null},"after":null},{"key":"identityProvider","label":"Upstream IdP","note":"Set when the sign-in was federated from somewhere else.","status":"removed","before":{"name":"identityProvider","raw":"http://schemas.microsoft.com/identity/claims/identityprovider","showRaw":true,"values":["live.com"],"origin":"assertion","conflict":null},"after":null},{"key":"authnMethods","label":"Authn methods","note":"How the user actually proved who they were: password, MFA, certificate.","status":"removed","before":{"name":"authnMethods","raw":"http://schemas.microsoft.com/claims/authnmethodsreferences","showRaw":true,"values":["http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password","http://schemas.microsoft.com/claims/multipleauthn","http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/unspecified"],"origin":"assertion","conflict":null},"after":null}],"tally":{"match":2,"differ":3,"removed":4,"added":0,"absent":0},"total":9,"subjectsAgree":false,"nameIdFormatChanged":true,"sameIdp":false}