Given a user's SID, how do I get their userPrincipalName?

should help you out Creating your proxies manually does not impede you from putting the configuration in the config file; you just need to expose the right constructor overload in your ClientBase-derived proxy class that delegates to the right constructor in ClientBase that takes the name of an endpoint to look up in the configuration.
That said, you can of course fill in the endpoint identity through code, you just need to create the right kind of EndpointIdentity-derived class and attach it to the EndpointAddress object you use when you instantiate the proxy class. Something like this:

EndpointIdentity epid = EndpointIdentity.CreateUpnIdentity("user@domain.fqdn");
EndpointAddress epaddr = new EndpointAddress(uri, epid);

MyClient client = new MyClient(epaddr);

it fixes the issue OK, don't know why I couldn't find this before, but first thing Monday morning the answer pops up immediately: http://msdn.microsoft.com/en-us/library/aa347735.aspx
The issuer element of the wsfederation is an endpoint config that allows you to set the user principal name within it.

<issuer address="Uri" >
   <headers>
      <add name="String"
                 namespace="String" />
   </headers>
   <identity>
           <certificate encodedValue="String"/>
      <certificateReference findValue="String" 
         isChainIncluded="Boolean"
         storeName="AddressBook/AuthRoot/CertificateAuthority/Disallowed/My/Root/TrustedPeople/TrustedPublisher"
         storeLocation="LocalMachine/CurrentUser"
                  x509FindType=System.Security.Cryptography.X509certificates.X509findtype/>
      <dns value="String"/>
      <rsa value="String"/>
      <servicePrincipalName value="String"/>
      <usePrincipalName value="String"/>
   </identity>
</issuer>

I think the issue was by ths following , In your case, you want to batch the creation of multiple users.
At present, the GraphClient does support batch processing but there are some limitation (Batch processing | Graph API concepts):

await activeDirectoryClient.Users.AddUserAsync(user, deferredSave: true);

await activeDirectoryClient.Context.SaveChangesAsync();

// Only 5 users per batch !!!!
var user1 = ...;
var user2 = ...;
var user3 = ...;
await activeDirectoryClient.Users.AddUserAsync(newStudentUser, deferredSave: true);
await activeDirectoryClient.Users.AddUserAsync(newTeacherUser, deferredSave: true);
await activeDirectoryClient.Users.AddUserAsync(newDirectorUser, deferredSave: true);

// In debug mode, you should use the SaveChangesAsync method with the default options
// Becasue the BatchWithIndependentOperations will not throw any exception even if there is a problem while creating the user.
//await activeDirectoryClient.Context.SaveChangesAsync();
await activeDirectoryClient.Context
    .SaveChangesAsync(SaveChangesOptions.BatchWithIndependentOperations);

I think the issue was by ths following , The problem here is that the -Members parameter of Add-ADGroupMember requires an identifier that is not UserPrincipalName. So you need to query for another identifier based on UserPrincipalName in this case. Since -Members accepts an array of ADPrincipals, you can update the membership with one command.

$UPNs = Import-Csv "C:\Temp\TESTGroup.csv"
$UIDs = Foreach ($UPN in $UPNs.userprincipalname) {
    (Get-Aduser -filter {UserPrincipalName -eq $UPN}).SamAccountName
}
Add-ADGroupMember "Group Name" -Members $UIDs

it helps some times I found out why.
For OneDrive/OneNote business env, OneNote business contents are synched into OneDrive storage, on the 'Notebooks' folder.