Hi @Alex- ,
I just saw a demo for using Azure as an Identity Provider on Smart-1 Cloud. I believe this issue is related to the fact that the default configuration in SmartConsole is to use the Gateway object's main IP, which is indeed the Tunnel IP in Smart-1 Cloud.
There should be an option to change this setting and set the external interface of the Security Gateway and by that to have the correct configuration to set in the Azure environment.
If I'm not clear or you already tried that with no success, I think we better meet for a remote session in which I will invite the feature owners from my side and you will invite the partner that has the access to the Azure environment.
Please let me know what fits you best.