Description of your changes

UserValidation currently always looks up userPrincipalName. For B2B guests, the tenant-specific UPN often differs from their mail address, so callers must expose or reconstruct a guest UPN to resolve a user.

This adds an optional userLookupField (userPrincipalName or mail). Omitting it keeps the existing UPN lookup. It works with both users and usersRef and leaves the returned user fields unchanged.

queryType: UserValidation
userLookupField: mail
usersRef: spec.owners
target: status.validatedUsers

Mail lookups fail on multiple matches or a paginated response rather than returning several principals for one requested owner. No-match behavior is unchanged (empty results). Filter values escape OData apostrophes, and unsupported lookup properties are rejected. No additional Graph permissions are required beyond the existing User.Read.All used for user validation.

Includes generated input schema, README documentation, and SDK request/response tests against a local HTTP server: default/explicit UPN, mail lookup of a guest with a different UPN, apostrophe escaping, no matches, ambiguous/paginated results and invalid field rejection. No live Entra calls or deployment are part of these tests.

Validation

• go generate ./input/...
• go mod tidy
• go test ./...
• go test -race ./...
• go vet ./...
• golangci-lint run (v2.12.2, matching upstream CI)

I have:

• Read and followed Crossplane's contribution process.
• Added or updated unit tests for my change.