<img border=0 src='https://avatars.githubusercontent.com/u/6068068?v=3' height=16 width=16'> Please hide all details of implementation by interface. SOLID...Class should be acceptable for extension not for MODIFICATION! The second part you should not rely on implementation of MultipartFileStreamProvider it can be changed...
<img border=0 src='https://avatars.githubusercontent.com/u/17322068?v=3' height=16 width=16'> If I use interface instead of AzureBlobStorageMultipartProvider. I can't use ReadAsMultipartAsync(_multipartStreamProvider) becuase this method requires paramater refernces to abstract class MultipartStreamProvider. As a result I need to make my own conten reading provider. Am I understand you?
<img border=0 src='https://avatars.githubusercontent.com/u/6068068?v=3' height=16 width=16'> Interesting case. But why you did't accept parameters into action body? Instear using Request property of ApiController? As I understand Web Api allows to have mixed parameters inside action signature.
<img border=0 src='https://avatars.githubusercontent.com/u/17322068?v=3' height=16 width=16'> I'm not sure exectly, I guess if user not null he has permissions to update photo. I check permissions because they can be changed in the azure out of code. So, if supose that permissions won't be changed in Azure this checking have no sence. Do I need get it away?
<img border=0 src='https://avatars.githubusercontent.com/u/17322068?v=3' height=16 width=16'> This method calls when user firstly register in our system and only way to get image url is to send request to GitHub get image, save this image to blobStorage and finally get the image url. Maybe it better to make two method one for getting image file and second for saving this image to blobStorage.
<img border=0 src='https://avatars.githubusercontent.com/u/6068068?v=3' height=16 width=16'> I see a small smell...You are exposing Users property and also declare GetUser method in interface? Do not many methods inside interface? Where our flexibility related to IOrderedQueryable?
I guess that method name is not the best. The idea is to check if the avatar url have changed than we need to update this field in database and delete unnecessary file from blobstorage. If url the same, there is no point to update url in database. Maybe the method name like IsUrlSimilar will be more clear.