Azure AD just keeps sending me to error url

Trying to do SSO with Azure AD.  Tried all the workarounds (removed Relay URL, set identifier to sp/munchkinid, set algorithm to SHA-1, every combination of those I could try).  No matter what, the Reply URL returns a 302 and then redirects me to whatever I have set as the Error URL.  Azure test always gives: Azure AD successfully issued a token (SAML response) to the application (service provider).

Questions:

Azure test shows NameID as urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

Marketo shows it as urn:oasis:names:tc:SAML:1.1:nameid-format:email

Is that an issue?

Has anyone actually ever gotten this to work?  Just plain vanilla Azure AD to Marketo SSO... u'd think for the amount of money we pay for both of these that it would just fn work.  I love contacting our Marketo Enterprise Support and being told there's nothing they can do and them just sending me links to discussions from this board 🙂