Which Microsoft Graph API to use to get UserID of a user external to an organization ?

Sudie 0 Reputation points
2023-07-17T23:34:55.7266667+00:00

I'm looking to get the user id of a user outside of an organization with email address.

Eg: I am from xyz.com tenant, I have an email address "******@abc.com". I'm looking to get the aad user id of ******@abc.com. Which Graph API can I use for that.

Here's what I've tried and the questions I have :

  1. Users api with filter - (Link) - This worked a couple of times but has been returning an empty result set. Why does it return an empty result set ?
  2. Using filter with graph users API. I'm stuck on this as I am unaware of how to get "issuer". If I try with the domain name as shown in the below example - I still receive an empty result set.
 .filter('identities/any(c:c/issuerAssignedId eq \'******@yahoo.com\' and c/issuer eq \'yahoo\')')

**
Questions :
Is searching for a user outside the current organization supported ?

  1. Which way would you recommend is reliable to find a user outside of an organization using just the email address ?
Microsoft Security | Microsoft Graph
{count} votes

2 answers

Sort by: Most helpful
  1. Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,526 Reputation points Moderator
    2023-07-19T05:43:25.96+00:00

    Hello @Sudie , in order to find/read a user object from another tenant you will need to gain access the user tenant. This is the reason why attempts within your own tenant are returning empty sets and why filtering by issuer will deliver the same result. If the user is external there won't be any information in your tenant. Issuer for guest user accounts is ExternalAzureAD.

    Let us know if you need additional assistance. If the answer was helpful, please accept it and rate it so that others facing a similar issue can easily find a solution.

    0 comments No comments

  2. CarlZhao-MSFT 46,371 Reputation points
    2023-07-19T09:18:29.65+00:00

    Hi @Sudie

    This is expected, you cannot get the id of a user outside of the organization.

    You can create a multi-tenant application in your tenant, then use an external user to log in to your multi-tenant application and obtain an access token, and finally call the /me endpoint.

    User's image

    Please note that you need to change /{tenant id} to /common when performing identity authentication.

    Hope this helps.

    If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.


Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.