To map existing Sitecore users with
Azure AD accounts based on email addresses, you can modify the code that handles federated authentication in your Sitecore instance. Specifically, you'll need to intercept the
authentication pipeline and add a custom code that checks for existing users with matching email addresses.
Here's a high-level overview of the steps you can take:
Create a custom processor that intercepts the authentication pipeline after the Azure AD authentication provider. You can use the
owin.authentication.identityProviders pipeline to achieve this.
In your custom processor, retrieve the email address of the authenticated user from the claims provided by the Azure AD authentication provider. You can access the claims using the
GetExternalClaims method of the
Query the Sitecore user database to check for any existing users with a matching email address. You can use the
Sitecore.Security.Accounts.UserManager class to retrieve users by email address.
If a matching user is found, set the authentication ticket for that user and bypass the rest of the authentication pipeline. You can use the
Sitecore.Security.Authentication.AuthenticationManager class to set the authentication ticket.
If no matching user is found, allow the authentication pipeline to proceed as normal, which will create a new user based on the Azure AD account.
Here's an example code snippet to get you started:
public class SitecoreAzureADMappingProcessor : Owin.Authentication.Pipelines.IdentityProviders.IdentityProvidersProcessor
public override void Process(IdentityProvidersArgs args)
// Retrieve the email address of the authenticated user from the claims
var externalLoginInfo = args.ExternalLoginInfo;
var email = externalLoginInfo.GetExternalClaims().FirstOrDefault(c => c.Type == ClaimTypes.Email)?.Value;
// Query the Sitecore user database for a user with a matching email address
var userManager = UserManager.GetManager();
var user = userManager.FindByEmail(email);
if (user != null)
// Set the authentication ticket for the existing user and bypass the rest of the pipeline
args.IdentityProviderHandled = true;
// Allow the pipeline to proceed as normal, which will create a new user based on the Azure AD account
You'll need to register your custom processor in the
owin.authentication.identityProviders pipeline in your Sitecore configuration file, like this:
<processor type="YourNamespace.SitecoreAzureADMappingProcessor, YourAssembly" resolve="true" />
Note that this is just a starting point, and you may need to modify this code to fit the specific requirements of your project