You could just be getting lucky on the production tenant as it will be more powerful than the QA and those identity attributes could be populated in time for use in the transform. Also the order of attributes in the production identity profile could be different? Either way it sounds like the configuration in production could be “sub-optimal” too.
Also intrigued by your Identity Attribute mapping for Employee ID. I notice it has sAMAccountName as input which (I assume) means that you are referencing the AD as source. Admittedly you may not be referencing the input implicitly in the transform, but slightly confusing to the viewer, I would say, as it implies a circular process, and, indeed could be causing some issues.
Also, attribute sync on sAMAccountName can’t be recommended. I’m just starting to wonder whether it works on your production tenant even more accidentally. Ie it creates the AD account with a random sAMAccountName, the AD account is aggregated back and updates the Employee ID according to the transform and then Attribute Syncs it back to AD (!).
Just re-read your post, when I say production read Dev.