Hi Jan,
The problem is that the out of the box SSO module is a blackbox, that only gives fullname to the createuser microflow.
This microflow creates an object in the account entity. You are free to customize that entity, although it is adviced to do changes to appstore modules in a local module, avoiding your to changes to be overwritten with a new version from the appstore.
So if you can deduce the logic to get the first name from fullname, you can add firstname to your account entity and change the way the createuser microflow behaves.
Another and maybe better option is to set-up another synchronisation with sap, using a regular odata service to fetch all relevant employee accounts and manage this data not in the administration.account, but in a separate module in your app. You will probably need that later on for the organizational/hierarchical positions of employees etc.