Hi, We started using MFA for our Azure AD B2C flows and we noticed that we started getting error messages when trying to send verification codes via SMS (this happened when multiple people were testing things on the same B2C tenant and using the MFA a lot). The error messages we are getting are the following: Sometimes we get: You hit the limit on the number of text messages. Try again shortly. Other times we get: The phone number you provided is unreachable. I was not able to find any documentation where the exact limits are explained. It would be useful to know when the limitation kicks in since we are doing a lot of testing at the moment and we want to know what to expect and how to avoid the issue from happening. From what I can tell there is a limitation at tenant level but also at IP/phone number level. Could you provide some information about these limits? Thank you!

@Cristina DC Azure Active Directory B2C (Azure AD B2C) integrates directly with Azure AD Multi-Factor Authentication so that you can add a second layer of security to sign-up and sign-in experiences in your applications. You enable multifactor authentication without writing a single line of code. As per following Multi-Factor Authentication limits there are no fixed limits (due to security to avoid any attacks) and could be configured from Parent Azure AD and B2C : AAD : B2C: Based upon your statement above we've confirmed that this issue happens due to a throttling done on our side to protect fraudulent activity' or other attacks. There're limits but these ones (for MFA) can't be shared publicly to avoid any threat attempts. Please do let me know if you have any further queries. Thanks, Akshay Kaushik Please "Accept the answer" (Yes/No), and share your feedback if the suggestion works as per your business need. This will help us and others in the community as well.

What are the quotas for sending MFA verification codes via SMS for Azure AD B2C?

Cristina DC 5

Hi,

We started using MFA for our Azure AD B2C flows and we noticed that we started getting error messages when trying to send verification codes via SMS (this happened when multiple people were testing things on the same B2C tenant and using the MFA a lot). The error messages we are getting are the following:

Sometimes we get: You hit the limit on the number of text messages. Try again shortly.
Other times we get: The phone number you provided is unreachable.

I was not able to find any documentation where the exact limits are explained. It would be useful to know when the limitation kicks in since we are doing a lot of testing at the moment and we want to know what to expect and how to avoid the issue from happening. From what I can tell there is a limitation at tenant level but also at IP/phone number level.

Could you provide some information about these limits?

Thank you!

1 answer

Akshay-MSFT 17,866 Reputation points Microsoft Employee

2023-03-28T16:12:21.9633333+00:00

@Cristina DC

Azure Active Directory B2C (Azure AD B2C) integrates directly with Azure AD Multi-Factor Authentication so that you can add a second layer of security to sign-up and sign-in experiences in your applications. You enable multifactor authentication without writing a single line of code.

As per following Multi-Factor Authentication limits there are no fixed limits (due to security to avoid any attacks) and could be configured from Parent Azure AD and B2C :

AAD:

B2C:

Based upon your statement above we've confirmed that this issue happens due to a throttling done on our side to protect fraudulent activity' or other attacks. There're limits but these ones (for MFA) can't be shared publicly to avoid any threat attempts.

Please do let me know if you have any further queries. Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes/No), and share your feedback if the suggestion works as per your business need. This will help us and others in the community as well.
Please sign in to rate this answer.
Cristina DC 5 Reputation points

2023-03-29T07:20:48.6566667+00:00

Hi @Akshay-MSFT

Thank you for your answer. It seems that the limits you specified here are the ones that are applicable at account level only.

In this other question I found: https://learn.microsoft.com/en-us/answers/questions/797036/azure-b2c-mfa-sms-throttling-hits-after-first-rese one of the answers specify this:

There are different MFA limits such as # of SMS per Tenant in 15 minutes, # of SMS per IP address in 15 minutes, etc. If those limits are hit, no new SMS verification code will be sent until throttling is lifted for the tenant \ IP address, etc.

Since B2C MFA relies on phone/SMS, there are also external factors that can interrupt the code delivery via SMS, like end user signal strength, carrier, network error, etc. This verification code lives for 180 seconds after requested, and if several codes are requested and failed to redeem, due to the reasons mentioned, the account can be temporarily locked.

Are these the only limits that are valid at tenant level? Are there more rules that are applicable and which might influence the sending of these SMSs?

It seems that there is no documentation that properly describes these limits, since I also encountered this open issue: https://github.com/MicrosoftDocs/azure-docs/issues/103673.

Are these limits that are described here general for all B2C tenants and where is the documentation for these limits? Since it looks like there is a limit at tenant level that might be applicable and this information is good to know for testing but also for the production scenarios.

Thank you in advance!

Cristina

Cristina DC 5 Reputation points

2023-04-04T12:07:02.43+00:00

Hi @Akshay-MSFT Could you please provide more details, as I already mentioned in my previous comment these SMS limits are not really fully documented anywhere, just bits and pieces here and there. There also seems to be a bug regarding this: https://github.com/MicrosoftDocs/azure-docs/issues/103673. Are there any plans to make this information available in the documentation?

Thank you, Cristina

Akshay-MSFT 17,866 Reputation points Microsoft Employee

2023-04-04T13:24:27.3733333+00:00

@Cristina DC Based upon your statement above we've confirmed that this issue happens due to a throttling done on our side to protect fraudulent activity' or other attacks. There're limits but these ones (for MFA) can't be shared publicly to avoid any threat attempts. Thanks, Akshay Kaushik

Akshay-MSFT 17,866 Reputation points Microsoft Employee

2023-04-12T07:33:50.2633333+00:00

@Cristina DC We noticed your feedback that the answer on this thread was not helpful. Thank you for taking time to share your feedback. Kindly let us know what we could have done better to improve the answer and make your experience better. Since I was able to validates with feature owner and the response in the latest post and update the solution, I request that you would kindly re-take the survey for your experience on this thread. We are here to help you and strive to make your experience better and greatly value your feedback. Looking forward to your reply. Much appreciate your feedback! Thanks, Akshay Kaushik
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

What are the quotas for sending MFA verification codes via SMS for Azure AD B2C?

1 answer

Your answer