Entra: the user id is not the sign-in name

The object id is the account

A sign-in row has a user id, the object id of the account in the directory, and a user principal name, the name recorded for that sign-in. The name can be changed later. The object id is how you find the same account in another row or in the directory.

The sign-in id, from a different lesson, identifies the event. The user id identifies the account on the event. Both belong in the note when you talk about who signed in.

Names get reused and renamed

Two rows can show the same principal name and two user ids. That is two accounts that have used that name, or a paste that mixed tenants. Do not add their sign-ins into one story. Two rows can show one user id and two principal names. That is one account whose name differed across the rows. Do not file them as two people.

If the user id was not exported, write “user id not in the export” and do not treat the principal name as a unique key.

What to file

File the sign-in id, the user id, and the principal name, each labeled. Group a series by user id when the question is about the account. Do not group by principal name when the user ids differ.

Worked case: one name, two object ids

The lab export has sign-in a1 with user id u-100 and name riley@hackblue-lab.org, and sign-in b2 with user id u-240 and the same name. A draft says riley signed in twice and adds the rows. The directory shows two accounts that have held that name.

The note keeps a1 on u-100 and b2 on u-240. It does not say one person signed in twice. The shared name is the label on each row. The object ids are the accounts.

sign-in a1  userId: u-100  name: riley@hackblue-lab.org
sign-in b2  userId: u-240  name: riley@hackblue-lab.org
write: two accounts
not: one person, two sign-ins