This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(22.400000000000002, 34%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVE%3C/text%3E%3C/svg%3E)
I noticed some strange behavior which does not make sense to me and I'm not sure if it's part of misconfiguration on my end.
When using the Password Reset flow (using the build-in flow, both as a dedicated flow or when doing the password reset using the link on the Signin-flow), the verification code is always sent to the provided email address, regardless if the user is known in the system or not.
The provided email address is only validated after the user validated the code sent via email. Does it not make more sense to not send a verification code when the email address is not know in AD B2C? Or did I forget to configure something?
I wanted to check in and see if you had any other questions or if you were able to resolve this issue?
If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.
If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
Hi @Van Eycken Steven , this is expected behavior! Do you ever get emails with OTPs that you didn't request, and they say to ignore them if you didn't request them? It's the same concept here. That way bad actors can't determine if a certain user exists in the system. Please let me know if you have any questions!
If this answer helped you please mark it as "Verified" so other users can reference it.
Thank you,
James