I’m developing a web application where I only have users’ UPNs (User Principal Names). I need to obtain individual tokens for each user based on their UPN without prompting them with an additional login window. Since I do not have access to users’ passwords, the goal of this authentication process is to enforce access restrictions to specific features based on each user’s permissions. Is this feasible to implement?

Specifically, my goal is to restrict MS search API results to show only sites accessible to each user. I have considered issuing tokens individually due to limited resources. I’m curious if there are methods to accomplish this or if there are alternative approaches.

I tried obtaining tokens by tenant id, but this token retrieves all sites’ information when I use the search API.