Are the error message localization string ID's customizable from entra external user flow's browser language JSON?

Question

Are the error message localization string ID's customizable from entra external user flow's browser language JSON?

Singh, Adarsh 0

Not able to customize error message for , "SignIn_InvalidEmailOrPassword_Error" ID in user flow's Browser language modification, is it possible to modify by any method?
and , can we add custom ID's for maybe Account Locked(after max no. allowed failed pswd retry attempts!), where do we find the list of supporting ID's?

JSON:-
{

"AttributeCollection_Description": "We just need a little more information to set up your account.",

"AttributeCollection_Title": "Add details",

"Attribute_City": "City",

"Attribute_Country": "Country/Region",

"Attribute_DisplayName": "Display Name",

"Attribute_Email": "Email Address",

"Attribute_Generic_ConfirmationLabel": "Re-enter {0}",

"Attribute_GivenName": "Given Name",

"Attribute_JobTitle": "Job Title",

"Attribute_Password": "Password",

"Attribute_Password_ConfirmationLabel": "Re-enter password",

"Attribute_Password_MismatchErrorString": "Passwords do not match.",

"Attribute_PostalCode": "Postal Code",

"Attribute_State": "State/Province",

"Attribute_StreetAddress": "Street Address",

"Attribute_Surname": "Surname",

"SignIn_Description": "Sign in to access {0}",

"SignIn_EmailAccountNotFound_Error": "We couldn't find an account with this email address.",

"SignIn_EmailHint": "Email address",

"SignIn_EmailOrPhoneHint": "Email or phone",

"SignIn_EmailOrUserNameHint": "Email address or username",

"SignIn_EmailOrUserNameOrPhoneHint": "Email address, username or phone",

"SignIn_EmailOrUsernameAccountNotFound_Error": "We couldn't find an account with this email address or username.",

"SignIn_EmailPhoneValidationError": "Enter a valid email address or phone number.",

"SignIn_EmailUserNamePhoneValidationError": "Enter a valid email address, username or phone number.",

"SignIn_EmailUserNameValidationError": "Enter a valid email address or username.",

"SignIn_EmailValidationError": "Enter a valid email address.",

"SignIn_InvalidEmailOrPassword_Error": "The Password you have entered is incorrect. After 5 failed attempts, your Logon will be locked. Use the Forgot your Password feature to reset your password.",

"SignIn_InvalidEmailUsernamePassword_Error": "We couldn't find an account with this email address, username, or password.",

"SignIn_NoPassword_Error": "Please enter your password.",

"SignIn_Title": "Sign in",

"SignUp_Description": "Sign up to access {0}",

"SignUp_Title": "Create account",

"SisuOtc_Title": "Enter code"

}

0 comments

1 answer

Your answer

Answer 1

Michele Ariis 7,215 MVP Volunteer Moderator

Hi , use two flows: (1) out-of-the-box: in Enter → Monitoring & health → Diagnostic settings send AuditLogs/SignInLogs/ProvisioningLogs to the Sentinel workspace; in Sentinel query AuditLogs (e.g. Category = EntitlementManagement, WorkflowManagement, TaskManagement) and create rules/Workbook; (2) granular “report” data (Access Review decisions, Entitlement assignments): Logic App/Azure Function schedule that calls Microsoft Graph (/identityGovernance/accessReviews/.../decisions, /entitlementManagement/accessPackageAssignments|...Requests) and ingests via Logs Ingestion (DCR) into a custom table (e.g. EntraIG_AccessReview_CL), then alerts on that. Permissions: Graph least-privilege (e.g. AccessReview.Read.All, EntitlementManagement.Read.All) + ingest permission on the workspace. Licensing/Cost: Entra P1 is sufficient for logging; you pay for ingestion in Sentinel. Checklist: Enable Diagnostics → Connect the “Microsoft Entra ID” data connector in Sentinel → Verify with Quick KQL → Deploy Logic App/Function + DCR → Create analytics rules.

Singh, Adarsh 0 Reputation points

2025-08-23T17:50:00.1366667+00:00

hi , i believe the answer u shared is regarding the log management for maybe failed sign-in attempts and account lockout;

but this doesn't satisfies my current hurdle, which is to modify/add the UI message in User flow for 1. "Wrong password", 2."Account lockout after reaching threshold limit"

any help in above requirement would be greatly appreciated!
Michele Ariis 7,215 Reputation points MVP Volunteer Moderator

2025-08-23T17:54:24.21+00:00

Hi, in user flows you can only override the string IDs that Microsoft exposes in the page’s downloadable language JSON; you can’t add new IDs (like a custom “account locked” string) and some service-side errors (e.g., wrong password) are not overridable there, even if you add SignIn_InvalidEmailOrPassword_Error, it will be ignored if that key isn’t supported by that flow/template. To fully change those messages you must use Custom Policies (IEF), where the built-in error IDs such as UserMessageIfInvalidPassword, UserMessageIfUserAccountLocked, and the sign-in DefaultMessage are supported and localizable. Practically: (1) in your user flow → Languages → download the default strings for each page; if a key isn’t present, you can’t customize it in user flows; (2) if you need custom text for “wrong password” or “account locked”, switch to Custom Policies and localize those IDs there; (3) there’s no way to invent new string IDs, only the documented ones are honored (list for Custom Policies is in the “Localization string IDs” doc).
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Singh, Adarsh 0 Reputation points

2025-08-25T16:06:55.84+00:00

Clarified, thanks
Raja Pothuraju 47,640 Reputation points Microsoft Employee Moderator

2025-08-26T11:33:19.4233333+00:00

Singh, Adarsh - If all your concerns have been resolved, I would greatly appreciate it if you could mark the answer as "Accepted." This helps both us and others in the community.

Share via

Are the error message localization string ID's customizable from entra external user flow's browser language JSON?

1 answer

Your answer