Microsoft Graph API delay fetching newly created guest user in Entra ID

Question

Microsoft Graph API delay fetching newly created guest user in Entra ID

Dimitrios Gkiokas 45

I'm encountering an issue when working with Microsoft Entra ID and the Microsoft Graph API. After programmatically creating a new guest user in Entra ID, I attempt to fetch this user immediately using the Microsoft Graph API. However, sometimes the API does not return the newly created user.

I suspect this might be due to some synchronization or propagation delay within the system. Has anyone experienced similar issues, and are there recommended strategies to handle this delay? Are there any best practices for ensuring that the user data is available promptly after creation?

Raja Pothuraju 23,465 Reputation points Microsoft External Staff Moderator

2025-01-13T04:21:02.2133333+00:00

Hello @Dimitrios Gkiokas,

Thank you for posting your query on Microsoft Q&A.

Based on your description, it seems you are trying to retrieve guest user details immediately after inviting them via the Microsoft Graph API. However, you have occasionally noticed that newly invited guest users do not appear in the list of guest accounts.

To better understand the issue, could you clarify how many seconds or minutes after inviting the guest users you are attempting to fetch the report using the Graph API?

Additionally, when the API does not return the newly invited guest user, can you confirm whether the user is visible in the Azure Portal under the "All Users" list?

Looking forward for your response.

Thanks,
Raja Pothuraju.
Dimitrios Gkiokas 45 Reputation points

2025-01-13T08:03:12.06+00:00

It's like a couple of seconds and it looks like it does not always happen.

But I'd like to know if Microsoft has some service agreement regarding how much time later the newly created guest will be available in Graph.
Dimitrios Gkiokas 45 Reputation points

2025-01-13T08:12:43.6133333+00:00

Hi and thanks for the answer.

I'm trying to retrieve the newly created guest user after a couple of seconds.

I'd like to know if Microsoft has a service agreement regarding the average/maximum time it's available via Graph.

Accepted answer

1 additional answer

Your answer

Raja Pothuraju 23,465 Reputation points Microsoft External Staff Moderator

2025-01-13T04:21:02.2133333+00:00

Hello @Dimitrios Gkiokas,

Thank you for posting your query on Microsoft Q&A.

Based on your description, it seems you are trying to retrieve guest user details immediately after inviting them via the Microsoft Graph API. However, you have occasionally noticed that newly invited guest users do not appear in the list of guest accounts.

To better understand the issue, could you clarify how many seconds or minutes after inviting the guest users you are attempting to fetch the report using the Graph API?

Additionally, when the API does not return the newly invited guest user, can you confirm whether the user is visible in the Azure Portal under the "All Users" list?

Looking forward for your response.

Thanks,
Raja Pothuraju.
Dimitrios Gkiokas 45 Reputation points

2025-01-13T08:03:12.06+00:00

It's like a couple of seconds and it looks like it does not always happen.

But I'd like to know if Microsoft has some service agreement regarding how much time later the newly created guest will be available in Graph.
Dimitrios Gkiokas 45 Reputation points

2025-01-13T08:12:43.6133333+00:00

Hi and thanks for the answer.

I'm trying to retrieve the newly created guest user after a couple of seconds.

I'd like to know if Microsoft has a service agreement regarding the average/maximum time it's available via Graph.

Answer 1

Hello @Dimitrios Gkiokas,

Thank you for your response and for sharing additional details about the task you are performing.

The scenario you are facing is an expected one, as there is a replication delay between the nodes. It's challenging to provide a guaranteed timeframe for this, as it largely depends on network connectivity and other contributing factors.

For more information, please refer to the following developer blog post, which explains this issue in detail with a flow diagram and provides workarounds for such situations:

https://blogs.aaddevsup.xyz/2021/08/why-do-i-sometimes-get-a-404-when-trying-to-update-an-azure-directory-object-after-i-just-created-it/

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks,
Raja Pothuraju.

Answer 2

Danstan Onyango 3,906 Microsoft Employee

Because of the Entra ID Distributed architecture, there is indeed a delay in the sync of resource after creation. The recommended solution is to always use a retry logic with exponential delay for subsequent operations to handle this.

You can read more on this on Entra Architecture Data consistency

Example to check if a user already exists, see this thread

Sometimes it does not happen if the create request and subsequent GET, PATCH requests hit the same data center which is never guaranteed.

Dimitrios Gkiokas 45 Reputation points

2025-01-13T09:41:12.81+00:00

Thanks again for the quick reply.

In my current setup I have like a two microservices, one for creating the guest user and one for calling Graph to get the user and adding them to an Entra ID security group.

Based on the docs you provided, it seems like if the operations are in the same logical session, then Microsoft guarantees read/write consistency, correct?

So I'm thinking to move the operations in the same microservice and perform them subsequently.

Also, do I need to provide any replica token to maintain affinity to the secondary replica? Or it just happens automatically behind the scenes?
Danstan Onyango 3,906 Reputation points Microsoft Employee

2025-01-13T12:09:26.47+00:00

I would suggest you implement the retry logic for checking user exists before you actually move the service. In most cases, retry logic is a good enough solution. If that does not work for you then move the actions to the same service. As for how the replication, I will need to do a dipper look to give any more details

Share via

Microsoft Graph API delay fetching newly created guest user in Entra ID

1 additional answer

Your answer