SSO Failing to Override Avatar

Hi all,

I have Discourse Connect enabled and am using a custom application for SSO. The relevant site setting for discourse_connect_overrides_avatar has been set to true. SSO is syncing the profiles both via the callback and via the admin/users/sync_sso endpoint. However, in both of these cases the avatars are not being overridden- all other properties that are intended to be updated (name, username, email) are updating properly.

It doesn’t appear from the logs that there are any issues. Here is a sample SSO log:

Verbose SSO log: User was logged on testuser

add_groups: 
admin: 
moderator: 
avatar_force_update: true
avatar_url: https://***.blob.core.windows.net/profile-pictures/05b14cb4-9a76-45a9-8850-c9bd1d35c0fa%25C5%2592This+is+a+test+%2524%2540%2523%2540.jpg
bio: 
card_background_url: 
email: testuser@yopmail.com
external_id: c8a93213-3b5e-4296-af6c-3e2e4259ba9c
groups: 
locale: 
locale_force_update: 
logout: 
name: Test User
nonce: 324152fe3a1de156b2b42bd558015ac7
profile_background_url: 
remove_groups: 
require_activation: 
return_sso_url: 
suppress_welcome_message: 
title: 
username: testuser
website: 
location: 

I’ve gone through the other threads around avatars not updating with Discourse Connect enabled, but none of the suggested solutions have worked. Any advice on resolving this or further steps to debug would be greatly appreciated

The above is on 2.7.13. I have confirmed that the avatar can be downloaded by Discourse and there are no additional logs suggesting there is an issue.