Apps Using PPI

> PwCPPI Being Sunset

As PwC moves to Identity as a Service (IdaaS) on Entra ID, some applications may need to change the unique identifier being used for users in their application.

Current State

Applications integrated into PwC Identity can use a number of unique identifiers:

• Accessed by: PwC Staff Only
• Current Unique Identifiers Used:
  • email
  • GUID
  • PartyID
  • PwCPPI

• Accessed by: PwC Clients / External Users
• Current Unique Identifiers Used:
  • email
  • PwCPPI

Future State

As part of migration activities to Entra ID, PwC applications with external users who rely upon PwCPPI as the unique identifier for its users must reconfigure their application to use another unique identifier, such as email or Entra Object ID (oid).

Entra ID unique identifiers

Entra ID offers several unique identifiers for its user objects: UPN, Email Address, and Object ID. Each is described below.

User Principal Name - UPN

For PwC Staff and Contractors

These users are referred to as Members in Entra ID, and their UPN is the same as their emailAddress

For External Users / Guests

This is an Entra ID calculated value based on the users email address. For example:

• You invite an external user to your application whose email address is bob.smith@companyabc.com
• Entra ID will create Bob with a UPN of bob.smith_companyabc.com#EXT#@pwc.onmicrosoft.com.

Entra ID will consitently follow this formula:

• Keeps the left-hand side of the user's email address (bob.smith)
• Changes the @ to an underscore (_) and adds the email domain (companyabc.com),
• Appends with #EXT# + your Entra ID tenant name which, in our case, is pwc.onmicrosoft.com

Email

The email address of the user, e.g. sally.smith@pwc.com or bob.smith@companyabc.com

Object ID - oid

This is an Entra ID-generated, globally unique identifier which, most importantly, is immutable. That is: it cannot be modified and will never change, even if the user updates their email or UPN.

When you grant a user access to a resource (like a Word document), it's this oid by which Entra ID identifies the user and grants permissions. That way if a user changes their email, they do not lose access to resources or groups.

note

If a user account is deleted and re-added, even if it has the same UPN and email, only then will the user have a new / different oid - and will thus lose access to previously granted resources and groups.

How does this affect my Entra ID migration prerequisites?

The answer depends on the makeup of your userbase and the unique identifier you from PwC Identity in your application.

My application is used by:     only

All current unique identifiers (email, GUID, PwCPPI or PartyID) for PwC Staff and Contractors are available in Entra ID on user objects. When your application migrates from PwC Identity to Entra ID, you can continue to use the same unique identifier.

✈️ Entra ID Migration Requirements: No hard requirements related to user unique IDs. When you migrate to Entra ID, your application will be configured to get the same unique IDs with the same attribute names in the token. However, as an industry-standard best practice, it's still strongly recommended to transition from PwCPPI to a different unique identifier.

---

My application is used by:     and  

✈️ Entra ID Migration Requirements:

• If you are using email as the unique identifier, when your application migrates from PwC Identity to Entra ID, you can continue to use email as the unique identifier.

• If you are using PwCPPI as the unique identifier, you need to update your application to use another unique identifier, such as email, or Entra Object ID (oid). PwCPPI is a PwC-generated number unique only to PwC.

Migration Guidance

To make the transition from PwCPPI ➡️ email or Entra Object ID (oid) easier for applications, the Identity team has developed a process in PwC Identity GUM:

1. GUM updates guest users in Entra ID, if they exist, with the PwCPPI from their account in PwC Identity.

2. The same process also takes the Entra Object ID (oid) of guest users in Entra ID and updates the PwC Identity account, if it exists, with the Entra ID Object ID. This allows application owners to either:

   • 🅰️ Switch to Object ID before they move to Entra ID or
   • 🅱️ Move to Entra ID while still using PwCPPI, then change shortly after migration.

If application owners choose Option B (migrate to Entra ID first, then move from PwCPPI to email or Entra Object ID (oid) later), they must consider the following:

• Some external/guest users might not have a PwCPPI on their account. As previously stated, PwCPPI is a PwC generated value. If the external/guest user was created in PwC Identity (GUM), the process we developed in GUM will copy their PwCPPI to their Entra ID account.
• In Entra ID external/guest users can be created outside of GUM. All M365 applications (Teams, SharePoint, OneDrive, PowerBI and many others) use Entra ID. In M365, if you share something with an external/guest user, they will automatically be created. Since it was created in Entra ID by M365 applications, there is no PwCPPI.

Frequently Asked Questions

✋ Can I change to another unique identifier even if the current one I use is in Entra ID?

Yes. There are no restrictions for an application to keep the same Unique ID. For example, if you use email and wish to change to Entra ID Object ID, that is supported. You will just need to work with Identity team to update Entra ID, but also update your application to accept the new Unique ID.

---

✋ Why is PwCPPI being deprecated for external users/guest in Entra ID, but not for PwC staff and contractor accounts?

In Entra ID, the process for creating users in your tenant is different for external/guest users than employees/staff (referred to as "Members" in Entra ID).

• External/guest users in Entra ID can be created by a few different means, but one of the most common ways is when you share an M365 resource (Doc, Sheet, PowerPoint, etc). It just happens automatically in Entra ID. Entra ID is a SaaS solution, we cannot update Entra ID to call the PwC service to get a PwC PPI. So, as we transition to Entra ID and off PwC Identity (GUM), PwCPPI goes away for external/guest users.

• PwC staff and contractors (i.e. "Members"), are not created directly in Entra ID like external/guest users. All Members in PwC Entra ID environment are sourced and synchronized from PwC managed systems (Workday, PMDM, One AD). This allows us to continue to populate PwCPPI for all PwC staff and contractors.

---

✋ When will PwCPPI be deprecated for External/Client Users?

PwCPPI for external/client users will be deprecated on July 1, 2026.

---

✋ Why is User Principal Name (UPN) different than email address for external/guest users, but the same for PwC staff and contractors?

In Entra ID while you have your own tenant, Entra ID is a global "single" directory. In your tenant you can only add members for which you own the domain namespace. For PwC we own pwc.com, and as such, we can add users with that UPN. When you do not own a domain namespace, when you add users, they are guests and thus are assigned the constructed UPN.

Behind the scenes, this guest account (in your tenant, with the constructed UPN) links back to the user actual account in their home tenant. This is the foundation of how Entra ID B2B works:

• Users have one account in their home tenant, e.g. bob@companyabc.com. When they are invited as a guest by another tenant, that guest account is linked back to their home tenant account. If you are invited as a guest in 100 other tenants, they all link back to your home tenant account.

• If Entra ID allowed the same account, UPN, in multiple tenants, there would be no way to know which account to link to when the user was added as a guest in another tenant.