When using multi SSO in your instance sso source field (<sso_source>) in sys_user table sometimes gets updated unexpectedly
There could be other processes/integrations accessing and updating sys_user table in an unexpected way
By default SSO source is to be populated manually with the sys_id of the IDP that the user belongs to. Kindly note that when using import, either via LDAP or Auto user provisioning, the transform maps can be configured to map this this field as well, provided the information is available in the source/staging table.
Additionally keep in mind there are several SSO scripts updating mentioned field such as script includes related. You can easily check them by going to: System definition --> Scripts includes and filtering by: name contains saml
Related documentation: Configure users for Multi-Provider SSO