MS Graph getting users' OnPremisesSamAccountName is always null

Question

I'm using MS graph in my app to perform a users search based as following

however the response is always only displayname and the onpremisessamaccountname is always null except for the signed in user it is showing

I'm not sure if this is a scope issue but here are my scopes

is there any possible way to get the onpremisessamaccountname attribute without requesting application scope. for security reasons?

So, calling MS graph API searching users with a prefix. the response should be list of users with their displayname and onpremisessamaccountname. however only the displayname is available for the list and the onpremisessamaccountname is always null except for the user himself who is searching

Answer 1

Note that, only users synced from on-prem AD to Azure Active Directory via Azure AD Connect have On-premises SAM account name value.

If users are getting null value for On-premises SAM account name attribute, it means they are created in Azure AD locally without any on-prem sync.

I have couple of users in my on-prem AD where I used Azure AD Connect to sync them like below:

From Portal, you can check those users by including On-premises SAM account name column with search filter like below:

I ran below query in Graph Explorer that uses Delegated permissions and got the response successfully like below:

GET https://graph.microsoft.com/v1.0/users?$select=onPremisesSamAccountName,displayName&$search="displayName:testuser"&$count=true
ConsistencyLevel: Eventual

Response: