At the moment, the Azure AD sync will use the Azure AD email address and the UPN as fallback for the synced Atlassian Account email address.

SAML-SSO attribute setting in Azure AD allows to map the email address (unique user identifier) to certain attributes in Azure AD. User provisioning via SCIM also allows this.

This can lead to duplicate accounts if the SAML-SSO attribute mapped is not the primary email as used by Azure AD sync.

Suggestion
To match Azure AD sync with SAML SSO and avoid duplicate accounts, allow the Atlassian Account email address to be mapped to an Azure AD attribute via Azure AD sync