azure - 微软图: How to look up a user by personal email address?

Question

实际上我有两个可能相关的问题:

问题 1:为什么用户个人电子邮件地址在 Azure 门户中显示为用户主体名称？

问题 2:如何通过个人电子邮件地址查找用户？

我要查找的电子邮件地址是用作登录名称的地址，因此我希望它应该出现在 signInNames 之类的属性中，如下所述。

重现步骤:

登录到 Azure 门户，查看随机用户并观察他们的用户主体名称。请注意，它以个人电子邮件地址 ( [email protected] ) 的格式显示。复制用户对象 ID。

在代码中，创建一个新的 GraphServiceClient 并使用在上面步骤中复制的对象 ID 通过对象 ID 检索用户。

GraphServiceClient client = GetGraphServiceClient();
User user = await client.Users[userID].Request().GetAsync();

在返回的 User 对象中，请注意 UserPrincipalName 的值不是 Azure 门户中显示的值，如第一步中所述。相反，它是一个分配的标识符:[email protected] .

尝试使用个人电子邮件地址 See also 查找用户:

GraphServiceClient client = GetGraphServiceClient();
IGraphServiceUsersCollectionPage users = await client.Users.Request().Filter("userPrincipalName eq '<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="a4cecbc1e4d7cbc9c1c0cbc9c5cdca8ac7cbc9" rel="noreferrer noopener nofollow">[email protected]</a>'").GetAsync(); // Count = 0
IGraphServiceUsersCollectionPage users = await client.Users.Request().Filter("mail eq '<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="f79d9892b784989a9293989a969e99d994989a" rel="noreferrer noopener nofollow">[email protected]</a>'").GetAsync(); // Count = 0

根据 this answer 推荐，这也不起作用:

IGraphServiceUsersCollectionPage users3 = await client.Users.Request().Filter("signInNames/any(x:x/value eq '<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="62080d0722110d0f07060d0f030b0c4c010d0f" rel="noreferrer noopener nofollow">[email protected]</a>')").GetAsync(); // error Filter not supported.

我的 Azure 应用程序具有 User.ReadWrite.All 权限。个人电子邮件地址不会显示为我检索的任何对象的任何属性值。

编辑

回应发布的答案here我尝试了这段代码:

// Exact call to graph:
    https://graph.microsoft.com/beta/users?$filter=otherMails/any(id:id%20eq%20'<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="573a2e7939363a32173822233b38383c7934383a" rel="noreferrer noopener nofollow">[email protected]</a>')
    
    Error message:
    
    System.NotSupportedException : The collection type 'Microsoft.Graph.IUserAppRoleAssignmentsCollectionPage' on 'Microsoft.Graph.User.AppRoleAssignments' is not supported.
    
    [Question regarding above error](https://stackoverflow.com/questions/62776361/how-to-use-graph-explorer-sdk)
    
    [Instruction to use GraphClient](https://learn.microsoft.com/en-us/graph/sdks/create-client?tabs=CS)

这里使用GraphServiceClient是我实现你的答案的方式。在这两种情况下，对图表的调用都会返回用户，但不会填充用户的属性。我的应用程序具有权限 User.ReadWrite.All、User.ManageIdentities.All、Domain.ReadWrite.All。这是权限问题吗？

    public async Task<User> GetUserByEmailAddress2(string email)
    {
        GraphServiceClient client = GetGraphServiceClient();
        IGraphServiceUsersCollectionPage users = await client.Users.Request().Filter($"otherMails/any(id:id eq '{email}')").GetAsync();
        var nonnullusers = users.Where(x => x.OtherMails?.Any() ?? false).ToList(); // count = 0
        
        users = await client.Users.Request().Filter($"identities/any(id:id/issuer eq 'LeaderAnalytics.onmicrosoft.com' and id/issuerAssignedId eq '{email}')").GetAsync();
        nonnullusers = users.Where(x => x.Id == email).ToList(); // count = 0

        return users[0];
    }

Answer 1

当电子邮件地址填充为备用电子邮件(otherMails 属性)时搜索用户:

• graph.microsoft.com/beta/users?$filter=otherMails/any(id:id eq ' [email protected] ')

当电子邮件地址填充为登录名(signInNames 属性)时搜索用户:

• graph.microsoft.com/beta/users?$filter=identities/any(id:id/issuer eq 'xxxx.onmicrosoft.com' 和 id/issuerAssignedId eq ' [email protected] ')