Microsoft Graph: How to look up a user by personal email address?

Admin 1
Viewed 4968

I actually have two questions which may possibly be related:

Question 1: Why does user personal email address appear in Azure portal as User Principal Name?

Question 2: How do I look up a user by their personal email address?

The email address I will be looking for is the one used as a sign in name so I expect that it should appear in a property like signInNames as is mentioned below.

Steps to reproduce:

Log into Azure portal, Look at a random user and observe their User Principal Name. Note it appears in the format of a personal email address (joe@somedomain.com). Copy the users Object ID.

In code, create a new GraphServiceClient and retrive the user by object ID using the Object ID copied in the step above.

GraphServiceClient client = GetGraphServiceClient();
User user = await client.Users[userID].Request().GetAsync();

In the User object that is returned, note the value of UserPrincipalName is not what is shown in Azure portal as noted in the first step. It is instead an assigned identifier: cpim_96fe-48b5-88a2-9ac960a6bdab@mydomain.onmicrosoft.com.

Attempt to find a user using personal email address See also:

GraphServiceClient client = GetGraphServiceClient();
IGraphServiceUsersCollectionPage users = await client.Users.Request().Filter("userPrincipalName eq 'joe@somedomain.com'").GetAsync(); // Count = 0
IGraphServiceUsersCollectionPage users = await client.Users.Request().Filter("mail eq 'joe@somedomain.com'").GetAsync(); // Count = 0

As recommended by this answer, this does not work either:

IGraphServiceUsersCollectionPage users3 = await client.Users.Request().Filter("signInNames/any(x:x/value eq 'joe@somedomain.com')").GetAsync(); // error Filter not supported.

My Azure Application has User.ReadWrite.All permission. Personal email address does not appear as any property value for any object I retrieve.

EDIT

In response to the answer posted here I tried this code:

// Exact call to graph:
    https://graph.microsoft.com/beta/users?$filter=otherMails/any(id:id%20eq%20'my.name@outlook.com')
    
    Error message:
    
    System.NotSupportedException : The collection type 'Microsoft.Graph.IUserAppRoleAssignmentsCollectionPage' on 'Microsoft.Graph.User.AppRoleAssignments' is not supported.
    
    [Question regarding above error](https://stackoverflow.com/questions/62776361/how-to-use-graph-explorer-sdk)
    
    [Instruction to use GraphClient](https://docs.microsoft.com/en-us/graph/sdks/create-client?tabs=CS)

Using GraphServiceClient here is how I implemented your answer. In both cases the call to graph returns users however the properties for the users are not populated. My application has permission User.ReadWrite.All, User.ManageIdentities.All, Domain.ReadWrite.All. Is this a permissions problem?

    public async Task<User> GetUserByEmailAddress2(string email)
    {
        GraphServiceClient client = GetGraphServiceClient();
        IGraphServiceUsersCollectionPage users = await client.Users.Request().Filter($"otherMails/any(id:id eq '{email}')").GetAsync();
        var nonnullusers = users.Where(x => x.OtherMails?.Any() ?? false).ToList(); // count = 0
        
        users = await client.Users.Request().Filter($"identities/any(id:id/issuer eq 'LeaderAnalytics.onmicrosoft.com' and id/issuerAssignedId eq '{email}')").GetAsync();
        nonnullusers = users.Where(x => x.Id == email).ToList(); // count = 0

        return users[0];
    }
microsoft-graph-api azure
5 Answers

To search users when email address is populated as Alternate Email (otherMails attribute):

  • graph.microsoft.com/beta/users?$filter=otherMails/any(id:id eq 'user@example.com')

To search users when email address is populated as Sign-in Name (signInNames attribute):

  • graph.microsoft.com/beta/users?$filter=identities/any(id:id/issuer eq 'xxxx.onmicrosoft.com' and id/issuerAssignedId eq 'user@example.com')
user_122682790

When using the C# SDK your call would be:

var users = await _graphClient.Users.Request()
                .Filter($"identities/any(id:id/issuer eq 'xxx.onmicrosoft.com' and id/issuerAssignedId eq '{emailAddress}')")
                .GetAsync();
user_5486550

None of these solutions worked for me. Here is what worked. You have to have the correct permissions, though.

I'm using https://graph.microsoft.com/v1.0 as the endpoint.

var officeUser = await graph.Users
            .Request()
            .Filter($"mail eq '{emailAddress}'")
            .Select(e => new {
            e.DisplayName,
            e.Mail,
            e.Id
            })
            .GetAsync();
user_53602370

Could you please try these Graph Calls:

https://graph.microsoft.com/beta/users?$filter=otherMails/any(id:id eq 'user@example.com') https://graph.microsoft.com/beta/users?$filter=identities/any(id:id/issuer eq 'xxxx.onmicrosoft.com' and id/issuerAssignedId eq 'user@example.com')

via Graph Explorer after signing-in with Global Administrator or User Administrator account by clicking on Sign in to Graph Explorer button on the left pane. Also make sure the user account that you are using is a member account in your B2C tenant (created via Azure Portal > Azure Active Directory > Users > New User > Create User option) and is not a guest or signed-up user.

Please let me know if this works and if you are making these calls under same user's context from your code.

user_122682790
user_140580990
Related