SSO and Email Addresses

What This Is For

When people sign in with Microsoft or OpenID Connect, or when Entra directory sync creates users, Skillhabit still needs an email-shaped identifier on each account. That value may come from a real mailbox field, from a principal name, or—when nothing usable exists—from Skillhabit’s placeholder domain @noemail.skillhabit.com (those addresses never receive system email).

This page explains how that address is chosen. It is not a setup guide for sync or login methods—use User Provisioning and SSO and Authentication. Delivery rules for placeholders and inactive mail: Bulk Actions and Email.

Who This Is For

Workspace administrators and identity admins troubleshooting why an SSO or synced user has an unexpected address—or no mailbox delivery.

Microsoft Entra ID Directory Sync

When Skillhabit synchronizes users from Microsoft Entra ID (Azure AD), it builds the Skillhabit email in this order:

1. mail — the directory mail attribute, when set.
2. otherMails — the first non-empty alternate address.
3. Guest / external UPN — if userPrincipalName looks like a guest account (…#EXT#@…), Skillhabit converts it to a normal address when possible (for example john.doe_contoso.com#EXT#@tenant.onmicrosoft.com → john.doe@contoso.com).
4. userPrincipalName — used when mail and other mails are empty (often already an email-like value).
5. Name or directory id — if none of the above exist, Skillhabit falls back to surname, given name, or the Microsoft user id.

Then:

Microsoft (Teams / Office 365) Sign-In

Interactive Microsoft login reads the signed-in Graph profile and picks:

1. mail, if present.
2. Otherwise a converted guest UPN when applicable.
3. Otherwise userPrincipalName.

Skillhabit then matches an existing user by that email, or by the Microsoft Graph integration id if the email does not match. New accounts are not created from this login path alone—provision users via Entra sync, SCIM, the External API, or an administrator first.

OpenID Connect Sign-In

For OpenID Connect, Skillhabit looks for an email-like claim in this order:

1. email
2. preferred_username (often email-shaped even when email is empty)
3. upn (user principal name)

If none of these claims are present, sign-in cannot complete (there is no address to attach to the Skillhabit user). Configure your identity provider to release at least one of these claims.

When a claim is present and valid, Skillhabit uses it as the user’s email. Prefer releasing a real email claim when people should receive Skillhabit notifications; use a deliberate @noemail.skillhabit.com value only when email delivery must be suppressed.

Practical Guidance

• Empty mail with a valid userPrincipalName / preferred_username is normal—Skillhabit uses the principal name as the address.
• Guest / B2B Entra users often only have a guest UPN; Skillhabit converts that when it can.
• To block all Skillhabit email for an SSO user, ensure their Skillhabit address ends with @noemail.skillhabit.com (Entra sync does this automatically when the directory has no valid email; you can also set that domain via API).
• Placeholder and inactive addresses cannot use Magic Links—keep Microsoft or OpenID Connect enabled for those users.

Related

• SSO and Authentication
• User Provisioning
• Introduction
• Notifications
• Bulk Actions and Email