Entra ID External ID - Email OTP Sign-in button allows double-clicks causing “Incorrect OTP code” error

Problem Type: Email One-Time Passcode (OTP)

Description:

We are using Entra External ID with email-based one-time passcode (OTP) authentication for CIAM.

When a user enters the correct OTP code and clicks Sign in, the Microsoft-hosted OTP verification form allows the Sign in button to be pressed multiple times in quick succession.

If the button is double-clicked or tapped rapidly, Entra responds with the error:

“An incorrect OTP code was provided.”

This only happens if the sign in button is hit multiple times quickly, before the page overlay appears disabling additional clicks. We have multiple customers reporting issues due to this bug.

I have tested other Entra ID External tenants and have been able to successfully recreate this issue there as well, including the WoodGrove groceries demo tenant that MS has created - https://woodgrovedemo.com/#usecase=EmailOtp.