Graph API requests for guest users in Azure AD

5
votes

I wanted to know how can we make graph API calls for guest users in Azure AD. I am able to achieve it for internal users using the API examples given here but the same calls are not working on guest user. Is there any difference in the way the requests need to be made?

2
azureazure-ad-graph-api
What exactly do you mean they are not working? What calls? - juunas
I mean the graph API calls on users described here(msdn.microsoft.com/en-us/library/azure/ad/graph/api/…) . For example the API call for getting user details: graph.windows.net/<tenantName>/users/… This works in the case of internal users. But in case of external users it returns a 400 response code. - adarsh hegde
In addition to the status code you should check the response body, it might have some more details. - juunas
For me the query you mentioned works with api-version=1.6. - juunas
Are you trying to find them with their user principal name (login name) or their object id? Because their user principal name is not the same in your directory, and it's one that can't be used in the URL - juunas

2 Answers

5
votes

Guest accounts in your tenant will have a different user principal name than the UPN they have in their home tenant. You should be able to see evidence of this by querying all the users in your tenant, and finding the external users which have a 'modified' user principal name, usually with "EXT".

You can see a direct example of this in our Demo Tenant here

"userPrincipalName": "djayachandran.cw_mmm.com#EXT#@GraphDir1.onmicrosoft.com",

It seems like you will need to query for these users using other properties where their old UPN is not changed, like the 'mail' property. Ultimately, you want to find the ObjectId of the user you are interested in, and use that as your key to find the user information. You should be able to get the object id from the token of the signed in user.

Let me know if this helps! Thanks, Shawn Tabrizi

0
votes

@Shawn Tabrizi's answer above helped me achieve what I needed (get Azure AD group info for logged in user).

To get the user AD ObjectID from the identity claims, I used this:

using System.Linq;
using System.Security.Claims;

namespace HealthcareEfficiencyService_webApp.Helpers
{
    public class ClaimsHelper
    {
        private readonly static string objectIdClaimsType = "http://schemas.microsoft.com/identity/claims/objectidentifier";

        public static string getAdObjectId(ClaimsIdentity claimsIdentity)
        {
            return claimsIdentity.Claims.FirstOrDefault(x => x.Type == objectIdClaimsType).Value;
        }
    }
}