diff --git a/pkg/iam/saml/service.go b/pkg/iam/saml/service.go
index b45500d25..d2601aaca 100644
--- a/pkg/iam/saml/service.go
+++ b/pkg/iam/saml/service.go
@@ -278,6 +278,12 @@ func (s *Service) HandleAssertion(
 			} else {
 				identity.EmailAddress = email
 				identity.FullName = fullname
+
+				// Identity can exist (e.g. provisioned via SCIM) but not have a SAML subject
+				if identity.SAMLSubject == nil {
+					identity.SAMLSubject = &assertion.Subject.NameID.Value
+				}
+
 				identity.EmailAddressVerified = true
 				identity.UpdatedAt = now