SAML2 - AEM CaaS issue for existing user in AEM not able to logged to repo

I am working on use case where we are integrating SAML with our application , basically for new user login we are setting up createUser as false so that whenever user is logged in from IDP server , that user should not create in AEM .

For existing user in AEM publish environment , it  should redirect to our portal , here no group is being return in Assertion response .Below is my SAML config

{
"path": [ "/content/csc-aem-commons/us/en", "/content/ipg-asc"],
"idpCertAlias": "$[env:SAML_IDP_CERT_ALIAS;default=certalias___1732570622676]",
"idpIdentifier": "$[env:SAML_IDP_ID;default=https://login.microsoftonline.com/d026e4c1-5892-497a-b9da-ee493c9f0364]",
"idpUrl": "$[env:SAML_IDP_URL;default=https://login.microsoftonline.com/d026e4c1-5892-497a-b9da-ee493c9f0364/saml2]",
"serviceProviderEntityId": "$[env:SAML_AEM_ID;default=https://publish-p135571-e1386830.adobeaemcloud.com]",
"useEncryption": false,
"userIDAttribute": "",
"createUser": false,
"userIntermediatePath": "ipg/idp",
"synchronizeAttributes":[
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress=profile/email",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname=profile/givenName",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname=profile/familyName"
],
"addGroupMemberships": true,
"groupMembershipAttribute": "http://schemas.microsoft.com/ws/2008/06/identity/claims/groups",
"defaultGroups": [
"Aem_deu_glb_agency_user"
],
"handleLogout":true
}

Problem :  we are getting an error for existin user as login token is not found , can someone help how can we fix this 

Getting this error