Yeah, SSO ist running now! With a little help from Support Engineer! And it works pretty much alright. I have to create new User Accounts manually, but I dont have to change the User Account Name in ALM. Where is your problem? The SAML Config? Probobly the Claim Type mapping? 

Did you ever get this SSO option to work to solve your issue? I have same scenario now... never could get SSO work.  Using LDAP still but, cannot get email address as username to work because of the @ syntax in the name.

Thank you for your helpful answer, I will activate SSO instantly

If your company will migrate from AD to Azure AD, it means the authentication of ALM will be changed to SSO from LDAP. You can map the Azure AD field of email address to ALM SSO unique field of 'IdentityKey'. With such configuration, the users are able to login with email via Azure AD and then the authenticated users are mapped to ALM users by the identity keys. 

Now what? Soon my company will migrate from Active Directory to Azure Active Directory, then LDAP is no longer available, because the sAMAccount Field name is no longer Available, comparable Field are filled with email Adress. Then the Security Risk valuation will increase, because I have to switch to local User Management, plus the User Acceptance of ALM will decrease.