How to identify the same user between windows server active directory and azure AD?

Question

I have an asp.net MVC web application, which is migrated from Windows authentication to Azure AD authentication.

On windows authentication, this.User.Identity.Name on controller returns domain\\alias, and on Azure Ad authentication, it returns alias@xxx.com.

The problem is sometimes, users' domain, alias or email may change. So which parameter can be used to identify the same user?

Answer 1

So which parameter can be used to identify the same user?

I think I understood your explanation. If I understand it correctly: Maybe we can use UserPrincipalName to identify the same user.

Azure Active Directory schema does not allow two of more objects to have the same value of the following attributes(This is not an exhaustive list.). That is each object in Azure AD is forced to have a unique value of these attributes at a given instance.

ProxyAddresses
UserPrincipalName
onPremisesSecurityIdentifier
ObjectId