Can the ADB2C password reset authentication code expiration time limit be modified? What is it - how long does the user have between the "forgot password" button click and having to enter the authentication code?

Question

Can the ADB2C password reset authentication code expiration time limit be modified? What is it - how long does the user have between the "forgot password" button click and having to enter the authentication code?

Answer 1

@Vijitha Chinthaginjala

Yes, you can customize the OTP timeout value.

This option is not available in User flows. However, this can be achieved if you use custom policy. You can check below URL and use the parameter "Use the "CodeExpirationInSeconds" tag to change the time.

https://learn.microsoft.com/en-us/azure/active-directory-b2c/one-time-password-technical-profile#metadata

Time in seconds until code expiration. Minimum: 60; Maximum: 1200; Default: 600. Every time a code is provided (same code using ReuseSameCode, or a new code), the code expiration is extended. This time is also used to set retry timeout (once max attempts are reached, user is locked out from attempting to obtain new codes until this time expires)

Do let me know if you have any further questions on this.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.