My guess, and I'm not an AD person so take it lightly: sAMAccountName holds the short login (jdoe), while userPrincipalName is the jdoe@yourdomain form. So if you typed the full address in the Test box, the first filter would find nobody. Was that the case? The docs list both filters but don't really say when to pick which: https://docs.xen-orchestra.com/users-and-access/users#ldap.
On the logging, if I read the plugin code right, it already logs how many entries the filter matched at debug level, it's just that the Test button only gives back "could not authenticate user". Showing that in the UI sounds like a good one for https://feedback.vates.tech/, where the XO team tracks this kind of request.
