title: Log Azure AD e-mail into ASP.NET Identity tables
body: <p>I'm making a report system which allows users to login using Azure credentials which then they'll subscribe/unsubscribe to reports.</p>
  
  <p>It's currently using ASP.NET Identity which works perfectly but requires more IT support with people forgetting their credentials etc.</p>
  
  <p>How would I save the Azure credentials into ASP.NET Identity? Like it does with other external providers like Facebook and so on or would you avoid using ASP.NET Identity all together and save the e-mail address to a table and reference that table instead of the ASP.NET Identity version?</p>
  
  <p>Startup.cs</p>
  
  <pre><code>            services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
              .AddAzureAD(options =&gt; Configuration.Bind("AzureAd", options));
  
          services.Configure&lt;OpenIdConnectOptions&gt;(AzureADDefaults.OpenIdScheme, options =&gt;
          {
              options.Authority = options.Authority + "/v2.0/";
  
              // Per the code below, this application signs in users in any Work and School
              // accounts and any Microsoft Personal Accounts.
              // If you want to direct Azure AD to restrict the users that can sign-in, change 
              // the tenant value of the appsettings.json file in the following way:
              // - only Work and School accounts =&gt; 'organizations'
              // - only Microsoft Personal accounts =&gt; 'consumers'
              // - Work and School and Personal accounts =&gt; 'common'
  
              // If you want to restrict the users that can sign-in to only one tenant
              // set the tenant value in the appsettings.json file to the tenant ID of this
              // organization, and set ValidateIssuer below to true.
  
              // If you want to restrict the users that can sign-in to several organizations
              // Set the tenant value in the appsettings.json file to 'organizations', set
              // ValidateIssuer, above to 'true', and add the issuers you want to accept to the
              // options.TokenValidationParameters.ValidIssuers collection
              options.TokenValidationParameters.ValidateIssuer = false;
  
              // Custom
              options.Scope.Add("email");
              //options.Scope.Add("profile");
              options.SaveTokens = true;
              options.GetClaimsFromUserInfoEndpoint = true;
  
              options.TokenValidationParameters = new TokenValidationParameters
              {
                  NameClaimType = "name"
              };
          });
  </code></pre>
  
  <p>Thanks for reading.</p>
  
  <p>EDIT:
  For now, I'm just using TokenValidated event then create user using UserManager with CreateAsync.</p>