I have an Azure Functions App (with HTTP API endpoint) which, upon triggered, needs to know the EMAIL ADDRESS of the caller; calling via the client-side (SPFx) JavaScript on the SharePoint Online Site.

I know, at the SP online side, I can get the @odata.context User Object and then grab the user's EMAIL ADDRESS from it, and then pass it as a variable (e.g, [email protected]) in the HTTP Request upon calling the Azure Functions App. But that variable can be spoofed and manipulated. I do not want to pass it as a variable.

Is there a better/proper way where SharePoint Client-side Javascript can make the HTTP Request to the Azure Functions App as the currently signed-in SharePoint User, and then the Azure Functions App can know who is calling?

Appreciate for the helps in advance.

2 Answers 2


In case you're using SPFx, you can use Azure Active Directory app registration and AadHttpClient to call the Azure Function. Then you can get user email from request info, I think.

More details about secured API: Sergei Sergeev and MS Docs.

  • Hi @Kiryl thanks for advising on using AaHttpClient which I figured out is the proper way to call the AAD protected Azure Functions. Although I still cannot figure out how to detect the User (e.g, who is calling) from the AAD + Azure Function end, I believe AaHttpClient is the fundamental client to use. Sep 28, 2022 at 7:35
  • I created new post (sharepoint.stackexchange.com/questions/304011/…) on how to detect the user, while using AadHttpClient. Please kindly follow if you can help with some advises. Sep 28, 2022 at 8:27

Except for passing parameters, I think there is no other way to know who called the API. The API can be called in places other than SharePoint. Like Postman, there is no information needed in the API at all in the request segment. If you are worried about inaccurate data, you can verify whether the mailbox belongs to your organization in the azure function.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.