Users from Asia/UK region are facing issue on Azure AD B2C Login with Email + OTP flow

Naveen Kumar (NVK) 20 Reputation points
2025-05-07T11:43:17.4933333+00:00

Azure AD B2C implemented in our application for the authentication flow (using custom policies). Currently, customers are facing the issue that email OTP was not received to their email on time (within 30 seconds). So, they clicked on “Send new code”, even though OTP has not received. Customers waited for 5 mins and tried sending new OTP frequently, then they received some code, but unable to choose the correct one to proceed. 

User's image

The issue seems to be region specific (Asia region) and not happening in India region. 

Kindly help us in this case.

Thanks,

Naveen

Microsoft Security | Microsoft Entra | Microsoft Entra External ID
{count} votes

Accepted answer
  1. Kancharla Saiteja 6,060 Reputation points Microsoft External Staff Moderator
    2025-05-22T13:28:54.6733333+00:00

    Hi @Naveen Kumar (NVK),

    Based on your query and the logs here is the summary of the issue:

    We have read the application insights and have found the working scenario has an expected behavior. We have seen the self-asserted technical profile has been called in the successful sign in attempt which is how the user provides an input of email address and move further for the authentication. This makes the authentication flow to identify the user account when it is sign up or sign in pages. The non-working scenario we have observed the sign in has called LocalAccountDiscoveryUsingEmailAddress-SignIn which usually used to identify the user account for password reset or password less authentication. Sign in or sign-up user journey calls sign in with email for claims exchange which has to be validated by LocalAccountSigninEmailExchange. Now to exchange the claims Self asserted technical profile is used. Here it verifies the user and proceeds for LocalAccountDiscoveryUsingEmailAddress-SignIn. This initiates the sign in for password less authentication. But here in this scenario, it has been called in the initial face itself and triggered which might be the reason user might see the email address page twice. Since we do not see any records of delay in insights, we believe the scenario of delay of OTPs might be dependent on the service providers now. Since the issue is intermittent, we may not be able to see the exact issue what has caused the issue.

    I hope this information is helpful. Please feel free to reach out if you have any further questions.

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.