How to add UPS users profile to a Site Collection without performing EnsureUser?

Question

I have a SP2013 farm with a User Profile Service populated with an External Identity Provider (MIM 2016 to be more specific). The Identity Manager takes users for several Active Directories and through the SPS-Claim properties (ADFS authentication will be used), it correctly provisions all users in the UPS setting the AccountName property as i:05.t|ClaimProviderID|userMail.

I have created an AD Group and assigned membership to all users synced in the UPS. Finally, I have assigned permission to my SharePoint Site Collection $url using the AD group.

The problem is that, if I run:

Get-SPUser -Web $url | select UserLogin

No user is visualized unless an .EnsureUser() is executed or a login is performed by the user.

To deeply investigate how SP is managing the users prior to the .EnsureUser(), I performed a .ResolvePrincipal(). The user is returned as PrincipalType.SecurityGroup (not good...) and the LoginName is the user E-mail and not the AccountName previously specified.

Since new users can be detected by the MIM any time, I would like the users to be directly linked to the site in order to be able to run the Get-SPUser without any additional operations. How to achieve this?

Answer 1

You can't. I would ask "Why?" you need to perform the Get-SPUser action before the user has even visited the site. Could you replace this action with a call to the User Profile Service?

The way SharePoint manages users at the site collection level is to populate the User Info List when the user visits the site for the first time. At that point the User Info List record for the site collection is created. The ID for the user is unique to the Site Collection only, it is not global.

You have two options, wait for the user to visit or call EnsureUser. A third alternative is to add the EnsureUser to your user provisioning workflow. BUT, if you just need the ID of the user from the User Profile, use a request from the User Profile Service instead.