Custom Authentication Extension (EmailOtpSend) attachment breaks signup with no diagnostic logs in External ID

The behavior matches Entra refusing to invoke the custom authentication extension because of a configuration/validation error that occurs before the REST call is made. In such cases, Entra returns only a generic error to the user and doesn’t mint a token or call the extension, and the detailed error is only visible in the sign-in logs for the app.

From the documented error model for custom authentication extensions:

• When an API call fails or the extension configuration is invalid, Entra does not mint a token and returns a generic error to the client for OpenID Connect apps.
• The error code that explains why the extension wasn’t invoked is surfaced only in Microsoft Entra sign-in logs under the Authentication Events tab for the affected sign-in.
• The error codes include both “pre-call” configuration/permission issues and “call-time” issues. Many of these prevent Entra from calling the REST endpoint at all.

Given that no HTTP request reaches the endpoint, the issue is almost certainly in this “pre-call” category. The relevant documented error codes and what to check are:

1. Domain / Application ID URI alignment
   • Error code 1003015 – CustomExtensionDomainNameDoesNotMatch: “The targetUrl and resourceId of the custom extension should have the same fully qualified domain name.”
   • Error code 1003014 – CustomExtensionIncorrectResourceIdFormat: “The identifierUris property in the manifest for the application registration for the custom extension, should be in the format of "api://{fully qualified domain name}/{appid}.”
   Even if the Application ID URI is set, Entra validates that:
   • resourceId (Application ID URI / identifierUris) uses the exact api://<fully qualified domain name>/<appId> format, and
   • The targetUrl host matches that fully qualified domain name.
2. Service principal existence and state
   • Error code 1003016 – CustomExtensionResourceServicePrincipalNotFound: “The appId of the custom extension resourceId should correspond to a real service principal in the tenant.”
   • Error code 1003017 – CustomExtensionClientServicePrincipalNotFound.
   • Error code 1003018 – CustomExtensionClientServiceDisabled.
   • Error code 1003019 – CustomExtensionResourceServicePrincipalDisabled.
   If the backing or client service principal is missing or disabled, Entra will not call the extension and will surface only a generic error to the user.
3. Permission / consent issues
   • Error code 1003021 – CustomExtensionPermissionNotGrantedToServicePrincipal: “The service principal doesn't have admin consent for the Microsoft Graph CustomAuthenticationExtensions.Receive.Payload app role (application permission) which is required for the app to receive custom authentication extension HTTP requests.”
   • Error code 1003022 – CustomExtensionMsGraphServicePrincipalDisabledOrNotFound.
   Even if consent appears granted, Entra validates that the service principal actually has the CustomAuthenticationExtensions.Receive.Payload app role and that the Microsoft Graph service principal is present and enabled.
4. Endpoint / URL validation
   • Error code 1003020 – CustomExtensionIncorrectTargetUrlFormat: “The target URL is in an improper format. It must be a valid URL that starts with https.”
   • Error code 1003023 – CustomExtensionBlocked: “The endpoint used for the custom extension is blocked by the service.”
5. Other configuration errors
   • Error code 1003011 – CustomExtensionNotFound: “The custom extension associated with an event listener couldn't be found.”
   • Error code 1003000 – EventHandlerUnexpectedError.
   • Error code 1003001 – CustomExtensionUnexpectedError.

In all of these cases, Entra can fail the sign-up/sign-in flow before any REST call is made, which matches the observation that the endpoint never sees traffic.

To get the actual reason in this scenario, the documented path is:

1. Go to the Microsoft Entra admin center.
2. Navigate to Entra ID → Enterprise apps → Sign-in logs.
3. Select the latest sign-in log for the affected app.
4. Open the Authentication Events tab.
5. Inspect the event corresponding to the custom authentication extension; the error code and details for the extension invocation (or pre-call validation failure) are shown there.

That error code can then be mapped directly using the documented error code reference to identify whether the issue is:

• Domain mismatch (1003015),
• Incorrect Application ID URI format (1003014),
• Missing/disabled service principal (1003016–1003019),
• Missing CustomAuthenticationExtensions.Receive.Payload permission (1003021),
• Target URL format or blocking (1003020, 1003023), or
• Another configuration error (1003000–1003003, etc.).

Once the configuration issue indicated by that code is corrected, Entra will begin calling the REST endpoint. If the endpoint then fails at runtime (timeout, invalid response, etc.), the same sign-in logs and error code reference (for example 1003002, 1003003, 1003005, 1003006, 1003009, 1003010, 1003007, 1003008, 1003024, 1003025, 1003026, 1003027) can be used to diagnose those issues.

References:

• Troubleshoot your custom authentication extension
• Extend authentication flows with your own business logic