Is oid unique across all tenants in AAD?

user_10665121 0
Viewed 1825

Do you know if the oid claim in an AAD access token is guaranteed to be unique across all tenants in AAD for both cases below:

  1. When it’s the object id representing a user;
  2. When it’s the object id representing a service principal of an app.

I'm specifically interested in case 2 since I was wondering if I can rely on one of below combinations from an AAD app token to recognize and authorize an app. Do you have some suggestions on what combination we should use:

  1. Oid alone;
  2. Oid + appId;
  3. Oid + appId + tid (tenant Id);
  4. others.

Thank you!

azure-active-directory
1 Answers

To answer your first question, oid claim or ObjectId property is immutable as well as Unique, so it should never change as well as uniquely identify the relevant directory object.

Special note only about oid claim for user object.. if a single user exists in multiple tenants, the user will contain a different object ID in each tenant - they are considered different accounts, even though the user logs into each account with the same credentials.

Here are a few reference links for this part: 1. oid claim for User - Azure AD Token Reference

enter image description here

  1. Service principal entity reference in Azure AD Graph API

    enter image description here

  2. Service principal entity reference in the beta version for Microsoft Graph API

On the second question, you haven't mentioned much about how or what scenario you're authorizing the service principal in. Usually for multi-tenant applications, service principal doesn't even exist before the consent process is done for a specific tenant (only exception being home tenant where service principal gets created right at the time of application registration, for all other tenants explicit consent process is needed).

Assuming consent process is done already, Service principal exists for this tenant and you're just authorizing/validating a call in some application using claims from incoming token, it would make sense to look at appid and tid claims as well, just to make logical sense of which Azure AD application this is and if the tenant is a valid one or not. So as per your options, it would be 3rd combination.

Here's a good read on Application/Service principal relationship for multi-tenant applications if you haven't come across it already.

Application and service principal objects in Azure Active Directory

user_101303850
Related