Why does e-mail verification needs to be done 2 times for self-service password reset in Azure Ad B2C?

Question

I'm trying to use self service password reset for my tenant in Azure AD B2C, but for some reason the verification of email needs to be done twice after you click on "Forgot your password?" link. Any idea why?

Answer 1

Hi @bogdan.bledea ,

I have received confirmation from products team and this is the default behavior that you are experiencing. You are seeing the MFA coming up twice while resetting the Password using the SSPR for B2C using the SignUp-SignIn Policies, as the default behavior for Password Reset flow (through SignUp-SignIn policies) is that you need to put you email and get the code sent to your email and once the code is entered to the B2C password reset page, you would be asked to enter the new password and confirm new password. But if you enable MFA for your SignUp-SignIn policy, and then try to reset the password, you would first go by the default flow for SSPR i.e enter your email address and get the code sent to your email and second, once you enter the code the next page is the MFA page, that would bring up the MFA method that is selected in the SignUp-SignIn Policy.
In case you want to update this behavior, you would have to use the custom policies.

Please let me know if you have any questions.

Thanks
Saurabh

Answer 2

Hi, I've also encountered this recently and its getting customers confused. They are wondering why they have to do the same verification step again and think its a bug. A custom policy for this seems a bit confusing and hard to write as you would need to disable the email verification if they've already done it as part of the password reset. Is there any Microsoft examples on how this could be done?