How to user details based on just his OID using graph API(User can be part of any tenant in AD)?

Question

Hello,
We are migrating users in our existing system which was using OID as unique identifier to identify a set of users to a new authorization system which requires some extra data of the user as well. So we were planning to use graph API to fetch the details, however since these users are spread across multiple tenants and we do not have the TID of the user. Is there a way/process to get the details of the user through graph API by just using OID or emailID?

Answer 1

Of course can not, you must have the user’s TID. In your scenario, these users are distributed in different tenants, even if you have the user’s OID, you cannot obtain user information from other tenants without authorization. And getting the user's TID is only the first step to solve the problem, and then you need to create a multi-tenant application in your tenant and grant User.Read.All application permissions to the application.

Then you need to add the multi-tenant application as an enterprise application to the tenant where the user is located, this requires you to run the admin consent url in your browser and log in with the administrator of the tenant where the user is located and consent. https://login.microsoftonline.com/{target tenant-id}/adminconsent?client_id={client-id}.

After you add the multi-tenant application to the tenant where the user is located, you can use the client credential flow to obtain the token, and then use the token to call the /users/{OID} endpoint to obtain the user information.

---

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in [our documentation][4] to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Thanks for the detailed answer. Is there a way I can get the TID of the user given his emailID(domain name) or using any other properties?