如何通过Microsoft Graph获取B2C租户的注册登录用户信息？

核心说明 #

B2C租户的注册用户与普通租户用户同属Graph API的users集合，区别在于B2C用户的identities属性会携带注册时的登录标识（邮箱/用户名），且issuer值为你的B2C租户域名。直接调用/v1.0/users未筛选时可能包含其他类型用户，通过筛选条件即可精准获取目标用户。

1. Microsoft Graph API实现 #

筛选B2C注册用户 #

使用$filter筛选出本地B2C账户用户，同时指定返回所需属性：

GET https://graph.microsoft.com/v1.0/users?$filter=identities/any(c:c/issuer eq '{你的B2C租户域名}')&$select=id,displayName,identities

替换{你的B2C租户域名}为实际域名（如contoso.onmicrosoft.com）

提取用户名 #

B2C用户的用户名存储在identities数组中：

• 邮箱注册用户：signInType为emailAddress，issuerAssignedId即注册邮箱
• 用户名注册用户：signInType为userName，issuerAssignedId即用户名

C#代码示例 #

using Microsoft.Graph;
using Azure.Identity;

var scopes = new[] { "https://graph.microsoft.com/.default" };
var tenantId = "你的B2C租户ID";
var clientId = "应用客户端ID";
var clientSecret = "应用客户端密钥";

var credential = new ClientSecretCredential(tenantId, clientId, clientSecret);
var graphClient = new GraphServiceClient(credential, scopes);

var b2cUsers = await graphClient.Users
    .Request()
    .Filter("identities/any(c:c/issuer eq '{你的B2C租户域名}')")
    .Select("id,displayName,identities")
    .GetAsync();

foreach (var user in b2cUsers)
{
    var loginId = user.Identities?
        .FirstOrDefault(i => i.SignInType is "userName" or "emailAddress")?
        .IssuerAssignedId;
    Console.WriteLine($"ID: {user.Id}, 用户名: {loginId}, 显示名: {user.DisplayName}");
}

2. PowerShell方案 #

准备工作 #

安装并连接Graph模块：

Install-Module Microsoft.Graph.Users -Force
Connect-MgGraph -TenantId "你的B2C租户ID" -ClientId "应用客户端ID" -ClientSecret (ConvertTo-SecureString "应用客户端密钥" -AsPlainText -Force) -Scopes "User.Read.All"

查询并输出用户 #

$tenantDomain = "你的B2C租户域名"
$b2cUsers = Get-MgUser -Filter "identities/any(c:c/issuer eq '$tenantDomain')" -Property Id,DisplayName,Identities

foreach ($user in $b2cUsers) {
    $loginId = $user.Identities | Where-Object { $_.SignInType -in "userName", "emailAddress" } | Select-Object -ExpandProperty IssuerAssignedId -First 1
    Write-Host "用户ID: $($user.Id), 用户名: $loginId, 显示名: $($user.DisplayName)"
}

3. Azure CLI方案 #

登录并配置 #

az login --service-principal -u "应用客户端ID" -p "应用客户端密钥" --tenant "你的B2C租户ID"

查询用户 #

az ad user list --filter "identities/any(c:c/issuer eq '{你的B2C租户域名}')" --query "[].{ID:id, 显示名:displayName, 用户名:identities[?signInType in ('userName','emailAddress')].issuerAssignedId | [0]}" --output table

内容的提问来源于stack exchange，提问作者user20262