Handling Unused Verification Codes in Microsoft Entra External ID.

Question

In Microsoft Entra External ID, we’ve noticed that unused verification codes generated for sign-up and two-factor authentication can still be used in two scenarios, even after a new code has been requested:

1. During the same registration/login attempt.
2. When the current registration/login process is canceled, and a new one is initiated.

While used codes are correctly blocked from reuse, unused codes remain valid and can be reused across new registration or login attempts.

Could you please clarify:

• Whether it’s possible to restrict the usage of old, unused codes in new registration or login attempts.
• If there’s a way to invalidate all previous codes whenever a new code is generated.

Answer 1

Hi @Aakash Goswami ,

Thanks for reaching out.

This is expected behavior as it is built-in functionality, and we cannot restrict the usage of old codes. However, each code can only be used once and will expire after 30 minutes if not used."

Hope this will help.

Thanks,

Shweta

Please "Accept the answer" if above answer helps you.