"User ID" can not be found in MS Entra ID!!

Question

"User ID" can not be found in MS Entra ID!!

reza admin 140

Hello,

Our report for Risky users in Entra ID, is showing a risky use with no user name. It only shows "User ID" which is a long string of Characters.

I can not find that string of Character anywhere in our system. I check it against existing users in Entra ID, and also in MS graph. No luck.

If you know how to find a username for that "User ID" please let me know. Thanks

0 comments

1 answer

Your answer

Answer 1

If the sign-in or risky user entry shows only a User ID / Object ID / GUID instead of a username, the documented causes are:

Passwordless authentication
Check the sign-in event details. If the authenticationDetail field says passwordless, the User ID can appear instead of the username.
The user authenticated but has not yet completed sign-in
Check whether the event has error code 50058. That correlates with an interrupt and can cause the username field to show an ID instead.
Tenant restrictions
If the username field shows something like 000000-00000-0000-0000, tenant restrictions may be preventing sign-in to the selected tenant.
Aggregation delay for multifactor authentication events
MFA sign-in attempts can be aggregated from multiple data entries. It can take up to two hours for the username to display properly.

For investigation, open the risky sign-in details and review the event fields, especially authenticationDetail and the error code. If this is a risky user entry, review the user’s risky sign-ins and risk history from Microsoft Entra ID > Security > Risky users.