@linh_tr_n the reply url seems to be incorrect, Azure receives a different value than configured. Update the reply url to:
https://legalontech.retool.com/api/saml/login
Note the api part is missing.
You’ll probably need to do the same for the login url. @Tess, It seems that the Retool docs are not correct.