We have a secondary AAD with guested users from a primary AAD. The token generated for the guest user appears to be missing the upn claim, but we are relying on the fact that the upn claim exists as that is what we are using to map users across systems.
I understand that the upn may be missing for guested Microsoft Live accounts, but these are full AAD accounts, just in another AAD. Microsoft’s documentation also suggests the unique_name claim may not actually be unique!!
https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-token-and-claims
Could you tell me what determines the value of the unique_name claim?
Is this safe for us to use this claim to fallback to if the upn claim does not exist or is an externally guested user?
Guest user token content
{
..,...
"tid": "xxxxxxxx-7ea7-413c-96bc-3f3aba133732",
"unique_name": "testAdmin@xxxxxxxx.onmicrosoft.com",
"ver": "1.0"
}
Regular user Token content:
{
......
"tid": "xxxxxxxx-72d8-4715-b14f-990c93843416",
"unique_name": "testAdmin@xxxxxxx.onmicrosoft.com",
"upn": "testAdmin@xxxxxxx.onmicrosoft.com",
"ver": "1.0"
}
I know you would probably like us to use the “oid” but this would cause us issues between environments as the same user will be a different value in each AAD.