使用Graph API无法获取跨租户用户邮箱的解决方案咨询

• Use the email delegated permission scope
  This scope is designed to access a user's email address and does not require admin consent. When you include email in your authentication request's scope list (alongside openid and profile):

  • The ID token returned during the OAuth flow will include an email claim containing the user's primary email address.
  • Calling the https://graph.microsoft.com/v1.0/me endpoint will also return the mail property in the response (provided the user has an associated email).
  • Example scope string: openid profile email

• Extract email directly from the ID token
  If you don't need additional user data from the Graph API, you can skip the /me call entirely. The email claim in the ID token (obtained after authenticating with the email scope) already contains the user's email address, eliminating the need for an extra API request.

Note: Ensure the user you're authenticating has a valid email address associated with their account; otherwise, the email claim or mail property may not be present.

内容的提问来源于stack exchange，提问作者Rik