Microsoft Connected accounts don't have Given / Family name

Get Help
,
1

Hi,

I’m trying to setup Microsoft as a Social connection in our application, but have run into some issues with the given/family name fields of Microsoft accounts. For context, we’re currently using Passwordless and Google as our connections. In our login flow, we have a custom Form that makes the user enter their given / family name after signup, and updates the “given_name” and “family_name” of that user account.

Whenever I sign in to our app with a Microsoft account, the “given_name” and “family_name” fields for that account never get set. In the Dashboard when I inspect the user account, under Identity Provider Attributes I can’t see the usual “given_name” and “family_name” fields, instead it has fields called “givenName” and “surname”

I’ve tried manually setting both “given_name”/“family_name” and “givenName”/“surname” for the accounts in our Form, but neither seem to apply to accounts signed up with Microsoft. On Azure’s side, I’ve made sure that the “given_name”/“family_name” claims are being included in the Id and Access tokens.

What’s the recommended way of setting / accessing the names for a user account connected with Microsoft?

3

Hi @michaela-sb

Welcome back to the Auth0 community!

You are asking how to read and set the given name and family name for users who sign in to your application with a Microsoft social connection, because the given_name and family_name values set by your custom Form do not apply to those accounts.

Solution: Auth0 stores the names Microsoft returns in the connection's raw profile data, where they appear as givenName and surname. The root given_name and family_name attributes are not filled from that data automatically, and Actions cannot write them directly. Copy the values into the root attributes with a post-login Action that calls the Management API, and have your Form read the root attributes.

  1. Confirm the connection and profile fields. In the Dashboard, open the user and expand the identity under Identity Provider Attributes. Note the exact keys for the name fields (for example givenName and surname). Also confirm the connection name (Microsoft Account is typically windowslive, and Azure AD is waad).
  2. Create a Machine-to-Machine application authorized for the Auth0 Management API with the update:users scope. Store its domain, client ID, and client secret as Action secrets.
  3. Add a post-login Action that runs only for the Microsoft connection and copies the names into the root profile when they are missing. Use the sample below and adjust the identity field names to match what you confirmed in step 1.
  4. Update your custom Form so it shows the pre-filled values and only asks for names that are still empty. Keep the Form write path to the same root attributes so the two sources do not conflict.
  5. Test with a new Microsoft account and an existing one. Check that given_name and family_name appear on the user's root profile and in the ID token.
const { ManagementClient } = require('auth0');

exports.onExecutePostLogin = async (event, api) => {
  if (event.connection.name !== 'windowslive') return;
  if (event.user.given_name && event.user.family_name) return;

  const identity = (event.user.identities || [])[0] || {};
  const profile = identity.profileData || {};
  const givenName = profile.givenName;
  const familyName = profile.surname;
  if (!givenName && !familyName) return;

  const management = new ManagementClient({
    domain: event.secrets.AUTH0_DOMAIN,
    clientId: event.secrets.MGMT_CLIENT_ID,
    clientSecret: event.secrets.MGMT_CLIENT_SECRET,
  });

  await management.users.update(
    { id: event.user.user_id },
    {
      ...(givenName && !event.user.given_name && { given_name: givenName }),
      ...(familyName && !event.user.family_name && { family_name: familyName }),
    }
  );
};

Notes on the Azure token claims: Adding given_name and family_name to the Azure app's token configuration does not change what the Auth0 Microsoft connection stores. The connection reads the profile from Microsoft directly, so the Action above is the reliable source.

Notes on name: The root name attribute stays as the email address until you set it. If you want it to show the full name, set it in the same Management API call.

Kind Regards,
Nik