I would recommend you to check the logs, there is a bit more lines of code written for samAccountName.
- I believe this is intermittent issue, i mean not for all users.
- Please check the logs for the respective user
- Check the user identity cube, if firstName and lastName are missing ?
Probability of not populating firstName and lastNameis very less, I agree that there is a chance but we can get more insights after checking logs. Based on that we can take a decision.
Also, can you confirm how AD account provisioning is triggered.
- Joiner life cycle event ?
- Business Role with Assignment Rule logic ?
- LCM manage access request ?