Any suggestions for troubleshooting when Microsoft Auth pulls in the wrong email address?

Product Support SSO

AI-generated summary

The discussion revolves around troubleshooting an issue where Microsoft Authentication pulls the wrong email address for a user. wesochuck reports that the plugin uses mail over userPrincipalName, causing the system to use user@*our-tenant*.onmicrosoft.com instead of the correct user@domain.org. agungor suggests the plugin prioritizes mail, and michaeld confirms this behavior, noting it’s easy to adjust via a setting. wesochuck plans to investigate further using Graph Explorer and considers updating AADConnect, as the cloud-synced account may be misconfigured.

1

We’re using the following plugin from @cpradio for Microsoft Authentication: Microsoft Authentication

We have a user reporting that when they try to login, the system attempts to use their user@our-tenant.onmicrosoft.com email address for their account rather than their reply-to/default SMTP address which is: user@domain.org

We’ve checked and the user@domain.org is the email address in the Azure AD account and is the primary/reply-to email address in their Exchange online account.

Mostly what I’m wondering is where I should be looking for log files to help troubleshoot what might be going on with this user?

2

My guess is that the plugin is prioritizing the mail property of the user resource over userPrincipalName. If this is the case, an update to the plugin should resolve the issue.

3

It indeed does exactly that! It should be fairly easy to add a setting for this.


info do
        {
          name: raw_info['displayName'] || raw_info['userPrincipalName'],
          email: raw_info['mail'] || raw_info['userPrincipalName']
        }
end
4

Thanks for this information. You can use the Graph Explorer to run a query to verify what information this plugin would read from the system.

In our case, we believe that there is some other error going on with the user account that we’d like to remedy rather than attempting to switch to the userPrincipalName. Although the account looks good on-prem, the cloud synced account doesn’t look right. We’re behind on our AADConnect version, so we’re updating that to see if it helps.

Thanks again for the help and the pointers!