Microsoft Azure AD graph API: How do I retrieve a user's email address?

Question

I am able to get access to a user's accessToken, and am making a call to GET https://graph.microsoft.com/v1.0/me with an Authorization: Bearer <token> header.

However, in the response body I'm getting something like this:

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users",
    "value": [
        {
            "givenName": "Foo",
            "surname": "Bar",
            "displayName": "Foo Bar",
            "id": "b41efha115adcca29",
            "userPrincipalName": "email.address@outlook.com",
            "businessPhones": [],
            "jobTitle": null,
            "mail": null,
            "mobilePhone": null,
            "officeLocation": null,
            "preferredLanguage": null
        }
    ]
}

The mail property is null, and the userPrincipalName in this response body happens to the be the user's email address. However, there's this from Microsoft's docs:

Although the UPN and email share the same format, the value of the UPN for a user might or might not be the same as the email address of the user.

When initiating the login request of the user, we're requesting for the "user.read" and "email" scopes. We're using the MSAL.js library to obtain the access token, and our code reads something like this:

login (): ng.IPromise<IMicrosoftOAuthResponse> {
  const prom = this.userAgentApplication.loginPopup(["user.read", "email"])
    .then((idToken) => {
      return this.userAgentApplication.acquireTokenSilent(["user.read", "email"]);
    })
    .then((accessToken) => {
      // at this point, we have the accessToken and make a call to the graph api
    });
  return this.$q.when(prom);
}

How do I get the actual email address of the user here?

Upon a quick reading of the docs for userEntity, userPrincipalName seems to always be the email of user. Main gist of it: The UPN is an Internet-style login name for the user based on the Internet standard RFC 822. By convention, this should map to the user's email name. The general format is "alias@domain". For work or school accounts, the domain must be present in the tenant's collection of verified domains. — vishwarajanand
Did you discover any userPrincipalName which does not have email instead? — vishwarajanand
From their docs: "Although the UPN and email share the same format, the value of the UPN for a user might or might not be the same as the email address of the user." docs.microsoft.com/en-us/azure/active-directory/connect/… — bioball
I thought its recommended to keep the UPN same as email. But it seems more like a general practice instead. This blog also suggests that many applications are actually using the UPN as email. — vishwarajanand
Yeah. It seems like the mail property should be the user's actual email address, but it's returning null. — bioball

Dan Kershaw - MSFT Dan Kershaw - MSFT · Accepted Answer · 2017-11-24T22:05:32

The mail property is set in one of 2 ways:

It's been set on on-premises AD, and then synchronized to Azure AD using AD Connect
The cloud user has been assigned an Office 365 license (and a mailbox), at which point the mail property is set for this licensed user.

If the user does not have an O365 mailbox/license, you could also search for the user by userPrincipalName, displayName, etc. $filter supports the OR operator.

Hope this helps,

Microsoft Azure AD graph API: How do I retrieve a user's email address?

3 Answers