Microsoft UserInfo uses Graph and access tokens may be opaque, so identity APIs should not assume JWT access tokens

Verified against Microsoft identity platform UserInfo docs (fetched 2026-05): UserInfo is hosted on Microsoft Graph (GET/POST https://graph.microsoft.com/oidc/userinfo) and Microsoft explicitly notes the Graph access token can be opaque/non-JWT; docs recommend using ID token claims as a superset for common profile fields. This affects generic OAuth libraries that assume JWT access tokens or always call UserInfo.

When implementing a cross-provider identity API, separate person identity from account/workspace metadata and keep fields nullable; for Microsoft specifically, prefer ID token claims first and call /oidc/userinfo or /me only when needed.