Microsoft Entra External ID: How to implement user sign-up via phone number without B2C?

Question

Hello everyone,

We are currently planning a Proof of Concept (PoC) using Microsoft Entra External ID for a new customer-facing application. Our goal is to implement a seamless and passwordless, phone-only authentication experience.

We have reviewed the documentation but have not found a clear, end-to-end guide for our specific requirements. For this PoC to be successful, we need to validate the following user journeys and capabilities:

Existing User Sign-In: An existing user must be able to sign in successfully using only their phone number and a one-time password (OTP) received via SMS.

New User Sign-Up: A new user must be able to complete a self-service sign-up process using only their phone number and an SMS OTP. Upon successful registration, the user should be automatically signed in.

Phone-Only User Interface: The user interface for both sign-up and sign-in must present only a field for the phone number. There should be no option for the user to enter an email address.

Full UI Customization: The entire SSO page (where the user enters their phone number and OTP) must be fully customizable, allowing us to apply our own branding, layout, and styles to match our application's design.

Could you please provide us with a detailed guide, configuration steps, or point us to the best-practice documentation for achieving this specific passwordless, phone-only user journey in Microsoft Entra External ID?

Answer 1

Hello @Valentyn Bulhakov

Thank you reaching out to Microsoft Q&A. I understand that you want your users to login using SMS, the setting for the same I have provided in the below screenshot. In the below screenshot we can clearly see that the SMS option is disabled by default and the admin can enable it.

In this screenshot admin can enable SMS authentication

SMS authentication is possible for after users are added into the Entra. Here in the below screenshot, I can add phone number to the user. This user is already added externally into this tenant.

Please refer to the below documentation of Microsoft where the process is explained with screenshots.

https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-sms-signin

Also please note there are list of applications which supports SMS based authentication. I'm providing the link of those below.

https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-sms-supported-apps

Also to make Non-Microsoft apps compatible with the SMS sign-in feature:

• Integrate Non-Microsoft web apps with Microsoft Entra ID and use Microsoft Entra authentication. Use Security Assertion Markup Language SAML or OpenID Connect OIDC to integrate with Microsoft Entra SSO.
• Integrate Non-Microsoft on-premises apps with Microsoft Entra ID using Microsoft Entra application proxy
• Integrate Non-Microsoft client apps with Microsoft identity platform for authentication

Regarding adding customization to your Sign-in page In Entra there is an option named "Custom Branding". Using this you can customize in your way. I'm pasting the screenshot for the same below for better understanding.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks,

Aditya

Answer 2

Based on the table on the following link, SMS-based authentication can be used for MFA only. Did Microsoft change SMS-based authentication from being used as a primary factor to being supported only as a secondary factor for user sign-in and sign up?

https://learn.microsoft.com/en-us/entra/external-id/customers/concept-supported-features-customers#authentication-methods-available-in-microsoft-entra-external-id

Answer 3

I am skeptical of the answers given stating it is possible, as the portal by SMS clearly states (at least it does now) "This authentication method will send a one-time passcode to the phone number. SMS can only be used for multi-factor authentication. It is not supported for first factor authentication or self-service password reset."

Answer 4

Hello Valentyn Bulhakov,

Thank you for the detailed question. Your goal to implement a seamless, passwordless, phone-only authentication experience using Microsoft Entra External ID is a great use case for the platform. You can indeed achieve all the capabilities you've outlined for your Proof of Concept.

Here is a guide to help you configure this specific user journey.

1. Enabling Phone-Only Sign-Up and Sign-In

First, you need to create and configure a user flow that exclusively uses phone numbers. This will address both your new user sign-up and existing user sign-in requirements.

1. Navigate to the Microsoft Entra admin center.

Go to External Identities > User flows.

Click New user flow and select the Sign up and sign in recommended flow.

Give the user flow a name (e.g., Phone_Only_SignUpSignIn).

Under Identity providers, this is the most critical step:

Check the box for Phone one-time passcode.

  **Uncheck** the box for **Email with password**.
  
  Under **User attributes**, you can leave the defaults for now.
  
  Click **Create**.
  

By configuring the user flow this way, you are explicitly telling Entra External ID that the only valid method for both registration and sign-in is a phone number with an SMS OTP.

2. Achieving the Phone-Only User Interface

The configuration in the previous step directly enforces the UI you want. Because you disabled "Email with password" as an identity provider, the sign-in/sign-up page generated by this user flow will only display a field for the phone number. Users will not see an option to use an email address, thus fulfilling your requirement for a phone-only interface.

3. Implementing Full UI Customization

Microsoft Entra External ID provides powerful options for UI customization, allowing you to go far beyond default branding.

Basic Customization (Company Branding): For simple changes, you can use the built-in Company Branding feature. This allows you to add your company logo, a background image, and customize the color scheme. You can find this under the Company Branding section in your tenant.

Full Customization (Custom Page Templates): To get the full control over HTML, CSS, and layout that you require, you need to use the custom page templates feature. This allows you to host your own HTML and CSS files and tell the user flow to use them.

Go to your Phone_Only_SignUpSignIn user flow.

  Select **Page layouts**.
  
     For the **Sign-up and sign-in page**, toggle **Use custom page content** to **Yes**.
     
        In the **Custom page URI** field, enter the URL of your own hosted HTML file. This file will serve as the template for the sign-up page.
        

With this approach, you have complete control to design the page layout to perfectly match your application's branding, while Microsoft handles the backend authentication logic securely.

By following these steps, you will be able to successfully build a PoC that demonstrates a fully branded, passwordless, and phone-only sign-up and sign-in experience for your customers.

Best Regards,

Jerald Felix