One suggestion is to remove the relay state in Microsoft Azure Single Sign-on settings. This field is not required in setting up SSO with Marketo.