Microsoft Entra ID: Picking email vs userPrincipalName (UPN)

[atonse]

Goals

Support extracting the username (userPrincipalName) when a Microsoft Account's email is blank.

Non-Goals

No response

Background

My client has a Microsoft Entra tenant which we created to test out Sign in with Microsoft. But they are not Microsoft customers, so do not have any mailboxes.

But when they do sign in with Microsoft, the response from Entra has a blank value for email since their emails are not automatically set (but they should have UPNs).

Should we be altering the provider to use userPrincipalName instead of email (when email is missing?).

For reference from similar libraries:

• the Elixir Ueberauth Microsoft library does fallback to userPrincipalName (link to code)
• the Ruby OmniAuth library does not fallback (link to code)
• Passport JS has an option addUPNAsEmail that does this (link to code)

How to reproduce

• Create a user in Entra without the email field set (you can still set a username/UPN)
• Log in with that user

Proposal

I'd recommend probably following PassportJS's example (above) by having a config option where users can configure whether to grab the email from the UPN where desirable.