3

Is there any way to tell whether a invited guest user is using either of the below to authenticate.

  • Microsoft Account (Personal Account)

or

  • Organisational Account (Work or School Account)

Account Types

1

Work and School account is considered corporate account stored somewhere in your on-premises or or Microsoft cloud identity service (Azure Active Directory). While Microsoft account (aka MSA in the context) is previously called Windows Live ID. Now Microsoft combines several things into a centralized system including Outlook.com, XboxLive, Skype, Hotmail or so on.

But note that Microsoft Account is not only Live.com. It can be even created under a Work Account (see the image below, I masked the alias but they are the same). In this real case, the Work Account is managed by Office 365 while Personal account is created under the user principal name.

See image

The difference is if you chose Personal account (whether it is Live or even the same user principal name with your corporate account), you are redirected to http://login.live.com/, while the login URL of Work account is

  • https://login.microsoftonline.com if the account is managed in Azure AD or Office 365
  • federation sign-in URL (e.g adfs.corporate.com) if the account is not managed in Azure AD.

From Azure AD portal, you can only see which one is Guest or Member, but Guest does not mean whether it is Microsoft account or Work.

The users identity in your Azure AD stores the source.

  • Azure AD
  • External Azure AD
  • Microsoft Account

From Azure AD in Azure Portal, click Users and groups > All users > . Click one user, then click Profile. Under Identity information, you then have the source of the indentity.

  • I came to the same conclusion, didn't reach out on here to see if there was any hope. Looks like I will have to raise with Microsoft support, as there needs to be way to tell the different for a very important reason. – RickWeb Feb 8 '18 at 17:23
  • I have just spotted [[Type=1,IdentityProvider=,Key=*************=]]; in the azure ad object for a user, i wonder if the key correlates to the identity provider. – RickWeb Feb 8 '18 at 17:32
  • If it is, still hard to identify as the key is populated under an algorithm we don't know. What I just found was to see only Source type of an Azure user object via Azure Portal. There are three types: Azure AD, External Azure AD, Microsoft Account. – EagleDev Feb 9 '18 at 2:33
  • Where do you see Azure AD, External Azure AD, Microsoft Account ? If had this information then this would solve my problem. – RickWeb Feb 9 '18 at 9:46
  • From Azure AD in Azure Portal, click Users and groups > All users > . Click one user then click Profile. Under Identity information, look at Source. Here is the ref photo of external Azure AD account thuansoldier.net/wp-content/uploads/2018/02/externalad.png And this is MSA thuansoldier.net/wp-content/uploads/2018/02/msaccount.png Note that it is from Azure Portal. I cannot seem to retrieve value of *Source property via Azure AD PowerShell ((Get-AzureADUser -ObjectId $UserId).ToJson() – EagleDev Feb 9 '18 at 12:33
3

You can retrieve this information using Powershell, AzureRm module and some hidden api that i couldn't find documentation anywhere :

Add-AzureRmAccount
$currentAzureContext = Get-AzureRmContext
$tokenCache = $currentAzureContext.TokenCache
$refreshToken = $tokenCache.ReadItems().RefreshToken
$tenantid = $currentAzureContext.Tenant.Id

$body = "grant_type=refresh_token&refresh_token=$($refreshToken)&resource=74658136-14ec-4630-ad9b-26e160ff0fc6"
$tokresponse = Invoke-RestMethod "https://login.windows.net/$tenantid/oauth2/token" -Method POST -Body $body -ContentType 'application/x-www-form-urlencoded'

$headers = @{"Authorization" = "Bearer $($tokresponse.access_token)"}
$objid = "<UserAccountObjId>"
$response = Invoke-RestMethod "https://main.iam.ad.ext.azure.com/api/UserDetails/$objid" -Headers $headers -Method GET
  • 1
    Could you mark this as an answer ? – Michael Guirao Mar 26 '18 at 12:55
  • I get Transmission data parser failure: Refresh Token is malformed or invalid on the first Invoke-RestMethod call. I also tried first explicitly url-encoding the refresh token before putting it in $body but that didn't help. – Nathan Sep 24 '18 at 23:20
  • You are right, this is not working anymore. I will have a look at it later – Michael Guirao Sep 26 '18 at 8:18
-1

Actually, If you invited a guest user to your directory, you have been using Azure AD B2B collaboration.

It's simple to know whther the account is using which endpoint to authenticate:

If a guest user is a personal account, it means that the account has not been created in another Azure Active Directory and its email account doesn't end with .onmicosoft.com. It should be authenticated with Live.com, also called Microsoft Account (Personal Account).

If a guest user is already existing in another tenant , it also means that its accout email ends with .onmicrosoft.com, it is authenitcated with .microsoftonline.com, also called Organisational Account (Work or School Account).

  • This would appear not to be the case. – RickWeb Feb 8 '18 at 17:22
  • I don't think using .onmicrosoft.com for anything is useful, as these accounts have custom domains more often than not – MichelZ Jul 5 '18 at 7:53
  • Hi @MichelZ. What I mean that .onmicrosoft is the member account. Of course, you can use a custom domain. – Wayne Yang Jul 5 '18 at 7:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.