For me this also sometimes happens on some clients. Clean all settings in browsers typical helps or use incognito. Don´t know if that is based on an setup error or it is just the browser sessions that have bugs

this happened to me for a while and it turned out that the token expiration time was wrong. see if the expiration time matches in azure and jamf.

I cannot see any token expiration date in azure on the Jamf app registration. can only see that In Jamf it should be set to 86400 which is max as far I can read

I only got it to work by disabling SAML token expiration

For future Googlers: I'm having issues like this with another integration, i.e.: Ping Identity.  It is not possible to disable the expiration there, only set the token timeout to a ridiculously high value.

I'm curious if anyone ever came up with a solution to this? I wasn't having issues until I upgraded my OS Monterey. Since then, it fails SSO in Safari every time. Other browsers seem to be fine though. Issue has persisted through Ventura beta testing. It feels like an Azure config issue somewhere.