Enable TOTP as 2FA for Entra External ID

Question

I want to enable Microsoft Authenticator or any other TOTP as 2FA for my Entra External ID tenant user for customers(CIAM). Is there any option to do that. I can only see email and SMS OTP options which is less secure consider everybody is implementing PUSH authentication or FIDO as MFA

Answer 1

As per the above response, I have pay atleast $6 or $9 for each customer user registered under the customer tenant. That is not affordable.

Answer 2

For Microsoft Entra External ID customer (CIAM) tenants, only two second-factor methods are currently supported:

1. Email one-time passcode (Email OTP)
2. SMS-based authentication

These are the only MFA methods available for customers in external tenants. Time-based one-time password (TOTP) apps such as Microsoft Authenticator in OTP mode or other generic TOTP authenticators are not listed as supported second-factor methods for CIAM users.

To enable and enforce what is available today:

1. Configure which MFA methods are allowed
   • In the Microsoft Entra admin center, go to Entra ID → Authentication methods.
   • Enable Email OTP and/or SMS as second-factor methods as described in the documentation.
   • For Email OTP as MFA, the local account authentication method must be Email with password; if Email with one-time passcode is used as the primary method, Email OTP cannot be used as the second factor.
2. Enforce MFA for customer sign-up/sign-in
   • Create a Conditional Access policy in the external tenant that targets the customer-facing app and requires MFA on sign-up/sign-in:
     • Go to Conditional Access → New policy.
     • Target the relevant users/groups and cloud apps.
     • Under Grant, select Grant access and Require multifactor authentication.

For stronger, phishing-resistant methods (like FIDO2, Windows Hello for Business, or certificate-based authentication), these are supported in Microsoft Entra ID generally, but the CIAM external-tenant documentation only exposes Email OTP and SMS as second factors for customer identities at this time. Push-based Microsoft Authenticator or generic TOTP for CIAM customers is not documented as an available option.

---

References:

• Multifactor authentication in external tenants
• Add multifactor authentication (MFA) to an app
• Authentication and Conditional Access for External ID
• What is Microsoft Entra authentication?
• Introduction to Microsoft Entra External ID