EntraId - Custom Auth Extension for MFA OTP Email Causes Duplicate Emails

Question

I'm working on a Custom Auth Extension for our EntraId tenant to trigger a custom MFA email, which is currently working, but we're also getting the original Microsoft MFA OTP email as well. Is there a way to prevent the Microsoft email from being sent if our extension is successful?

Answer 1

Hi, from what you’re describing, you’re effectively adding a second email, not replacing the Microsoft one. The EmailOtpSend Custom Authentication Extension is meant to let you plug in an alternative email provider for the Email one-time passcode scenario (mainly for Entra External ID). In that model, Microsoft should not send its own OTP email unless you explicitly enable the fallback to Microsoft provider (which only kicks in if your API fails). So if you’re in that flow and you’re seeing duplicates, the first thing to check is that fallback isn’t enabled and that the extension is correctly assigned to the app.

However, if what you’re really doing is trying to customize or replace the standard workforce MFA email OTP in a normal Entra ID tenant, then this is the key point: there is no supported way to suppress the built-in Microsoft MFA email when using a Custom Auth Extension. Custom extensions are not designed to override or replace the default MFA notification mechanisms; they only augment specific flows (like External ID email OTP).

If your goal is truly to bring your own MFA experience (and your own email or OTP delivery), the supported path is to use External Authentication Methods (preview) and integrate an external MFA provider, rather than trying to intercept or replace the native email OTP flow.