NameIdentifier vs ObjectIdentifier
<p>I have a multitenant ASP.NET application using OpenIdConnect and Azure AD as an Identity provider for Office 365. When the user is authenticated I receive my claims in <code>ClaimsPrincipal.Current</code>.</p>

<p>I wanted to identify a user and store this id reference in my database. I asked <a href="https://stackoverflow.com/questions/36722037/claims-difference-between-upn-name-with-azure-ad/36723217#36723217">this question</a>.
It was replied that </p>

<blockquote>
  <p>When trying to identify a user uniquely [NameIdentifier] should be your go-to choice.</p>
</blockquote>

<p>But it seems that the <code>NameIdentifier</code> claim, <code>http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier</code>
depends on the application. Precisely, if I create another application in Azure  AD then, the <code>NameIdentifier</code> will not be the same for the same <em>real</em> Office365 user. Keep in mind that the we may have to create another Azure AD manifest (because we could need other scopes) and we should be able to find back the same end-users.</p>

<p>Meanwhile, I remarked another claim: <code>ObjectIdentifier</code> <code>http://schemas.microsoft.com/identity/claims/objectidentifier</code></p>

<p>It seems that <code>ObjectIdentifier</code>, is the same for all Azure AD-secured application for a given Office 365 user.</p>

<p>Can you explain precisely the difference between those two claims? And more importantly, can you confirm that the <code>ObjectIdentifier</code> can be used as an "universal" identifier for a user in any Office 365 subscription.</p>