The SSO Agent cannot communicate properly on port 636. This error message appears:

DN (User) is not valid.

Configure LDAPS communications on port 389.

For more information, see this Microsoft article: https://support.microsoft.com/en-us/help/4546509/frequently-asked-questions-about-changes-to-ldap.