The vulnerability stems from using Azure AD's mutable email claim for authentication instead of the immutable subject (sub) identifier. The primary vulnerable function would be in the Azure AD OAuth handler where user identity is established. While exact code isn't shown, Grafana's architecture patterns suggest the UserInfo method in AzureADProvider would handle claim extraction, and SocialBase would contain generic OAuth claim processing logic. The high confidence for AzureADProvider comes from Microsoft's explicit guidance against email-based identification, while the SocialBase function gets medium confidence as it's a common pattern in OAuth implementations.