Why are we getting Claim not Verified errors on a B2C login?

Cade Kachelmeier 0 Reputation points
2025-04-14T20:16:27.8933333+00:00

We're using Azure B2C to have users log into our application using OAuth 2 PKCE on our frontend. We have a conditional policy to do MFA with the user's email. In most cases the workflow is working fine, but we're getting sporadic cases where users are getting the error Claim not verified: [Email Address]. It can happen on both the initial email/password screen and the email verification screen. Clicking to sign in again or verify the email code continues to return the same error, but refreshing the screen seems to fix it by starting the workflow over. We've been able to reproduce it in some specific conditions, but haven't been able to figure out the underlying reason.

Case 1: Our QA tester is able to reproduce it with these steps

  1. Logging in with his admin account
  2. Log out
  3. Log in with a different specific test user.

It only seems to happen on his specific machine and with specific users.

Case 2:

  1. Open 2 tabs with our OAuth application
  2. Start the login process in tab 1.
  3. Start the login process in tab 2.
  4. Enter email and password on tab 2. Don't click to send the email verification code.
  5. Go back tab 1 and enter your email and password.

This one makes sense to me since the cookies are shared between tabs and tab 2 seems to be expecting the verification code instead of an email/password.

The user logs don't even seem to show failed logins when this is happening, so I'm not sure how to track this issue down.

Microsoft Security | Microsoft Entra | Microsoft Entra ID
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.