User ids need to be globally unique. You can either provide your own unique uuid or you can let FusionAuth provide them for you. But these values are not tenant scoped.

UUID v4

More details about datatypes in general: https://fusionauth.io/docs/v1/tech/reference/data-types

Thanks for the reply @dan.
We ended up storing sub ID on our side. We thought that might gives us more flexibility down the road (not sure about this but if it doesn't work then we'll have an extra column in the db; a small price to pay IMHO).

"Where to map the ID?" was a bit headache for us as we didn't want to miss it or make an extra call by polling ourselves. Since we are using .NET Core, we ended up hooking into OnUserInformationReceived event, one of many from OpenIdConnectEvents. Hopefully, I'm not doing something really stupid.