Hight cost on SMS MFA in B2C and conditional access not working

Hello Edgar Rocha,

This is expected behavior in Azure AD B2C when SMS MFA is enabled.

In B2C, the SMS is sent before Conditional Access is checked, so it can still be billed even if access is blocked later. Also, hiding the sign-up link (setting.showSignupLink = false) only changes what users see. The sign-up technical profiles were still reachable, which is how automated requests were able to create users.

What you’ve done with Front Door and Cloudflare is the right long-term approach. To prevent this going forward:

• Keep Front Door / Cloudflare with bot protection and rate limiting
• Remove the sign-up technical profiles and related steps from the custom policy (not just the UI link)
• Avoid SMS where possible and use Email OTP or an authenticator app
• Add CAPTCHA if sign-up is ever enabled again

To confirm the fix, try signing in using the same policy URL with an email that doesn’t exist. The sign-in should fail and no new user should be created.

For the refund, I’ve shared the steps with you in a private message on how to create a support ticket with the Billing team, who will handle that separately.

References:

• https://learn.microsoft.com/en-us/azure/active-directory-b2c/phone-based-mfa#mitigate-fraudulent-sign-ups-for-user-flow
• https://learn.microsoft.com/en-us/azure/active-directory-b2c/conditional-access-user-flow