_api/web/siteusers does not return user until I check users permissions

Question

We are getting ready to migrate from SP 2010 to SP online and I noticed something strange - if I query a user who hasn't signed in yet to our new SharePoint site using _api/web/siteusers(@v)?@v='User i:0#.f|membership|[email protected]' I get no results. If I then just go to permissions in SP online and check if someUser has permissions (which they may or may not have), then by merely checking someUser's permissions now _api/web/siteusers behaves correctly. Does that make sense?

Note: We are using AD

Another strange thing is that the people picker in the permissions form instantly recognizes someUser so it seems half of SP is aware and another half is clueless

Answer 1

Yes, this makes sense if you understand how SharePoint tracks users. the siteusers endpoint works by querying a hidden list called the User Information List. If a user has never logged into the site collection, or had never been referenced in the site collection in some other fashion, the user will not have an entry in the list, so as far as SharePoint is concerned, that user does not exist in the site, even if they may have access through an AD group.

Besides logging into a site, certain other activities, like adding the user to a People field in the site, or, as you've discovered, checking permissions, will trigger the process to add the user to the site. The basic process to trigger this process via REST is to call the EnsureUser endpoint. This endpoint will return information about the requested user, adding them to the site if they're not already there.

EnsureUser: https://msdn.microsoft.com/en-us/library/office/dn499819.aspx#bk_WebEnsureUser

User Info List (old but still correct): https://zimmergren.net/sharepoints-hidden-user-list-user-information-list/