i do believe your AD query filter would be
(UserPrincipalName=%{session.logon.last.username})
as the UserPrincipalName is what is available, assuming UserPrincipalName is the same as the email address, else you need to search on the email address. lookup the attribute name in AD for that.
before that you have to assign the UserPrincipalName to the session.logon.last.username from the returned SAML attribute. which you can lookup in your APM sessions. it probably is: session.saml.last.identity
what is your IdP? is that Azure AD, it can also return the sAMAccountName.