Hi Andrew,
You needn’t even do a full google LDAP lookup (pun intended) on this. Maybe a https://discourse.metabase.com one is sufficient:
http://discourse.metabase.com/search?q=Ldap
In that list I think LDAP Debugging is particularly well written. I like its:
Just by looking at your post above I’m getting a suspicion either email
in your filter or userPrincipalName
just below could be off. I would expect that attribute name to match. Otherwise at least make sure they are both populated (for everyone) you use with Metabase.