Azure login rejects allowed UPN when contact email uses another domain

Is there an existing issue for this?

• I have searched the existing issues

This is not related to configuring Outline

• The issue is not related to self-hosting config

Current Behavior

A new user cannot join an Outline workspace through the built-in Microsoft Azure/Entra provider when their Entra ID Email field differs from their User Principal Name (UPN) domain.

Example identity:

• User principal name: [email protected]
• Email: an address on a different, private domain
• Outline allowed domain: company.example

Microsoft authentication succeeds, but Outline rejects account provisioning with:

The domain is not allowed for this workspace

The server log shows:

DomainNotAllowedError
    at userProvisioner
    at async accountProvisioner

The configured allowed domain is correct. The failure occurs because Outline selects the Email field and passes it to Team.isDomainAllowed, rather than checking the UPN domain.

In the Microsoft Graph API, the Entra ID Email field is returned as the mail property.

Expected Behavior

Outline should permit the user when the directory-managed UPN belongs to an allowed domain.

When the Entra ID Email field is available, it should still be possible to use that address as the Outline user’s contact email for notifications. Domain authorization and contact email may represent different identity attributes.

Steps To Reproduce

1. Configure Outline with the built-in Azure provider and AZURE_TENANT_ID.
2. Add company.example under Settings → Authentication → Restrictions.
3. Create or use an Entra user with:
   • UPN [email protected]
   • Email on another domain
4. Attempt the user’s first Microsoft login.
5. Microsoft authentication succeeds, but Outline redirects back to login with a domain-not-allowed error.

Environment

• Outline: 1.9.0

Proposed approach

• Keep the contact email and authorization domain separate.
• Use the Entra ID Email field (Microsoft Graph mail) as the Outline user email when available.
• Use the userPrincipalName domain for workspace allowed-domain validation.
• Fall back to the selected email domain when UPN is unavailable.

@tommoor, would you agree with this approach? If so, I would be happy to submit a PR.