To migrate without triggering a re-auth loop:
Provision the new SAML app in your IdP before disabling the legacy connection
Map existing user attributes to the new assertion format — mismatched NameID is the most common cause of loop behavior1
Enable parallel auth temporarily so both connections are live during cutover2
Disable the legacy connection only after confirming session continuity — invalidate persistent tokens or they'll re-auth against the old flow3