How to get the email of intune device assigned user through Graph API?

[Arun_Joseph]

I'm using the following API to fetch the managed device properties and it has a field named emailAddress but it is empty

API : https://docs.microsoft.com/en-us/graph/api/intune-devices-manageddevice-get?view=graph-rest-1.0

Response :

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#deviceManagement/managedDevices",
    "@odata.count": 1,
    "value": [
        {
            "id": "90b67389-2856-43ed-8142-cxxxxxxxxxx",
            "userId": "e99a55d5-fe5d-4142-ad8f-xxxxxxxxxxx",
            "deviceName": "arun.xxxxx_AndroidForWork_7/1/2021_2:34 PM",
            "managedDeviceOwnerType": "company",
            "enrolledDateTime": "2021-07-01T14:34:07Z",
            "lastSyncDateTime": "2021-07-15T07:43:20Z",
            "operatingSystem": "Android",
            "complianceState": "compliant",
            "jailBroken": "false",
            "managementAgent": "mdm",
            "osVersion": "8.1.0",
            "easActivated": true,
            "easDeviceId": "afw21FB64B73D7Exxxxxxxxxxxxxx",
            "easActivationDateTime": "0001-01-01T00:00:00Z",
            "azureADRegistered": true,
            "deviceEnrollmentType": "deviceEnrollmentManager",
            "activationLockBypassCode": null,
            "emailAddress": "",
            "azureADDeviceId": "xxxxxxxx-16fe-4a9e-8bcd-xxxxxxxx",
            "deviceRegistrationState": "registered",
            "deviceCategoryDisplayName": "Unknown",
            "isSupervised": false,
            "exchangeLastSuccessfulSyncDateTime": "0001-01-01T00:00:00Z",
            "exchangeAccessState": "none",
            "exchangeAccessStateReason": "none",
            "remoteAssistanceSessionUrl": null,
            "remoteAssistanceSessionErrorDetails": null,
            "isEncrypted": true,
            "userPrincipalName": "arun.joseph@xxxxxx.onmicrosoft.com",
            "model": "Nexus 6P",
            "manufacturer": "Huawei",
            "imei": "xxxxxxxxxx",
            "complianceGracePeriodExpirationDateTime": "2021-07-15T03:41:27Z",
            "serialNumber": "xxxxxxxxxxx",
            "phoneNumber": "",
            "androidSecurityPatchLevel": "2018-12-05",
            "userDisplayName": "Arun Joseph",
            "configurationManagerClientEnabledFeatures": null,
            "wiFiMacAddress": "xxxxxxxxxxx",
            "deviceHealthAttestationState": null,
            "subscriberCarrier": "",
            "meid": "xxxxxxxxx",
            "totalStorageSpaceInBytes": 0,
            "freeStorageSpaceInBytes": 0,
            "managedDeviceName": "arun.joseph_AndroidForWork_7/1/2021_2:34 PM",
            "partnerReportedThreatState": "unknown",
            "iccid": null,
            "udid": null,
            "notes": null,
            "ethernetMacAddress": null,
            "physicalMemoryInBytes": 0,
            "deviceActionResults": []
        },
    ]
}

Note:

1. I have redacted some values with xxxx for obvious reasons

2. I have enrolled this device using company portal android app

As u can see, the emailAddress field is empty but userPrincipalName field is giving the user's mail id.

but I'm not sure if userPrincipalName will always have the email of the mapped user.

My questions:

1. Will userPrincipalName  field always have mapped user's email?

2. When will the emailAddress field be empty and when will it have value? 

Kind regards,

Arun Joseph

[#2 · Accepted solution]

Upon getting this record above, simply call the get-azureaduser -objectid arun.joseph@xxxxxx.onmicrosoft.com | select mail
OR
Get-azureaduser -objectid $somestring.userPrincipalName | select mail

Microsoft seperates Intune / Azure / MS Online in the 3 seperate containers and you sometimes need to poke into one or all 3 to build a dataset.

[#3]

To echo Justin, I am not aware of a simple way to get the email if the UPN is different. You will more than likely can achieve this by building a script or leveraging power automate. Personally I would build it out in Power Automate and build a Power App or Power Virtual Agent in front of it. That way you can build out a repo of popular used commands for yourself.