[ebarault]

Description of your changes

UserValidation currently always looks up userPrincipalName. For B2B guests, the tenant-specific UPN often differs from their mail address, so callers must expose or reconstruct a guest UPN to resolve a user.

This adds an optional userLookupField (userPrincipalName or mail). Omitting it keeps the existing UPN lookup. It works with both users and usersRef and leaves the returned user fields unchanged.

queryType: UserValidation
userLookupField: mail
usersRef: spec.owners
target: status.validatedUsers

Mail lookups fail on multiple matches or a paginated response rather than returning several principals for one requested owner. No-match behavior is unchanged (empty results). Filter values escape OData apostrophes, and unsupported lookup properties are rejected. No additional Graph permissions are required beyond the existing User.Read.All used for user validation.

Includes generated input schema, README documentation, and SDK request/response tests against a local HTTP server: default/explicit UPN, mail lookup of a guest with a different UPN, apostrophe escaping, no matches, ambiguous/paginated results and invalid field rejection. No live Entra calls or deployment are part of these tests.

Validation

• go generate ./input/...
• go mod tidy
• go test ./...
• go test -race ./...
• go vet ./...
• golangci-lint run (v2.12.2, matching upstream CI)

I have:

• Read and followed Crossplane's contribution process.
• Added or updated unit tests for my change.

[ebarault]

someone to review this ?

[blacksoxx]

Pulled the branch and ran it with Go 1.26.0, the version CI uses: go vet ./... is clean, go test ./... passes, the new table test passes under -race (all nine cases), and go generate ./input/... leaves the tree unchanged, so the packaged input schema matches the Go type. The ambiguity guard treating a paginated response as ambiguous is the right call for something that feeds grants, and the OData literal escaping now also covers the UPN path, which previously interpolated the value as is. From my side this looks good to merge; the call is the maintainers'.