Single Sign On: We use ADFS for SSO. The federation identifier is a email like string and Salesforce federation identifier is case sensitive. 

I am working with a complex Active Directory/SSO infrastructure where the Federation Ids of some users keep changing. There is a delay involved in syncing these changes on Salesforce user records by our 3rd party identity manager. 

So lets assume, a user's federation identifier has changed and he gets the error page in SFDC when trying to login, is there a way to figure out the SAML data passed on to salesforce for this user? Is there a way to collect logs of SAML failures containing the federation ids/name ids? 

The latest failure will appear in the SAML assertion validator in Salesforce Admin but I need all login failures where federation id did not match or user records are inactive. 

May be I could use these information to figure out a match with user records and track users who are getting impacted proactively