What Active Directory field do I use to uniquely identify a user?

I have an Asp.net MVC project authenticating through AD. I would like to store audit information in tables for the current logged in user. What should I be storing in the database? I am currently using SamAccountName for my membership and role providers. Should I be using this? Should I use the more verbose and modern UserPrincipalName? What if we eventually end up using multiple domains?

Can I use Entity Framework with ASP.NET Membership?

I’m creating (really, re-creating) an app that has existing user and other data in MS-Access databases. The data will be moved to SQL Server, and part of that involves migrating users. I want to use EF to do ORM, and I am pretty sure I know what the data model will be in SQL Server. I am new to EF but not to ASP.NET, and I’d like to take advantage of the Membership features in ASP.NET. I am thinking about several ways to do this and would like some advice. I’ve done only a little research about this idea thus far, maybe it’s been answered elsewhere. So, here goes a cluster of related questions.

ASP.NET Multi tenant application with tenant specific roles

We have a multi-tenant ASP.NET application. So far tenants have been isolated from each other, however now we have Agencies that manage multiple tenants and want to be able to manage all their tenants with a single user account. I’m trying to figure out the best way to accomplish that, hopefully without much change to the existing technologies that we are using.