How to handle unknown email addresses and password reset behavior in Microsoft Entra External ID SignInSignUp flow?

Question

How to handle unknown email addresses and password reset behavior in Microsoft Entra External ID SignInSignUp flow?

BHANU PRATAP SINGH 10

I am working with a Microsoft Entra External ID (Customer) tenant using the built-in SignInSignUp user flow, and I would like clarification on supported behavior for unknown users and password reset scenarios.

Scenario

We have:

Local accounts (email + password) enabled

Google/Yahoo federated identity providers configured

Conditional Access policy enforcing MFA

Self-Service Password Reset (SSPR) enabled

Expected User Experience

We would like the flow to behave as follows:

User enters email address.

Based on domain:

Federated domains (Google/Yahoo) → redirect to respective IdP

  Local domain → show password textbox
  
  If the email is **not registered in the tenant**:
  
     Show password screen
     
        Provide “Forgot password” link
        
        If password is correct:
        
           Trigger MFA (if required)
           
           If user clicks “Forgot password”:
           
              Verify email
              
                 If account exists → send reset link / OTP
                 
                    Complete password reset
                    
                       Enforce MFA during sign-in

Questions

In built-in SignInSignUp flows, is it possible to customize behavior when a user enters an email address that is not registered?

Is there a supported way to:

Show different UI behavior for existing vs non-existing users?

  Control how the password page appears based on email existence?
  
  Does Entra intentionally prevent revealing whether an account exists (anti-user enumeration protection)?
  
  If advanced control is required (such as domain-based routing + preconditions), is Azure AD B2C with custom policies the only supported approach?

Environment Details

Tenant Type: Microsoft Entra External ID (Customer)

Using built-in user flows (not custom policies)

MFA enabled via Conditional Access

SSPR enabled

We are trying to design a secure and user-friendly onboarding experience while staying within supported Entra External ID capabilities.

Any clarification on supported vs unsupported customization options would be greatly appreciated.

Rukmini 43,995 Reputation points Microsoft External Staff Moderator

2026-02-26T11:55:22.02+00:00
Hello BHANU PRATAP SINGH

The Microsoft Entra External ID's built-in SignInSignUp user flows include:

You cannot modify behavior according to the existence of an email.

You cannot show separate UI for those who are already there and those who are not. Depending on the existence of your email, you cannot control password page display.

This cannot be turned off and is by design to prevent user enumeration attacks.

Using custom policies (Identity Experience Framework) in Azure AD B2C is the only method supported if you require domain-based routing or sophisticated conditional logic. This degree of modification is not supported by built-in flows.

Let me know if any further queries - feel free to reach out!
Rukmini 43,995 Reputation points Microsoft External Staff Moderator

2026-02-27T03:21:04.2333333+00:00

Hello BHANU PRATAP SINGH Following up to see if the above provided information was helpful. If you have any further queries do let us know.

1 answer

Your answer

Rukmini 43,995 Reputation points Microsoft External Staff Moderator

2026-02-26T11:55:22.02+00:00

Hello BHANU PRATAP SINGH

The Microsoft Entra External ID's built-in SignInSignUp user flows include:

You cannot modify behavior according to the existence of an email.

You cannot show separate UI for those who are already there and those who are not. Depending on the existence of your email, you cannot control password page display.

This cannot be turned off and is by design to prevent user enumeration attacks.

Using custom policies (Identity Experience Framework) in Azure AD B2C is the only method supported if you require domain-based routing or sophisticated conditional logic. This degree of modification is not supported by built-in flows.

Let me know if any further queries - feel free to reach out!
Rukmini 43,995 Reputation points Microsoft External Staff Moderator

2026-02-27T03:21:04.2333333+00:00

Hello BHANU PRATAP SINGH Following up to see if the above provided information was helpful. If you have any further queries do let us know.

Answer 1

In the built-in SignInSignUp user flows of Microsoft Entra External ID, there are some limitations regarding customization for handling unknown email addresses and password reset behavior:

Customization for Unknown Users: The built-in user flows do not allow for extensive customization based on whether an email address is registered or not. Specifically, you cannot show different UI behavior for existing versus non-existing users directly within these flows. This means you cannot control the appearance of the password page based on email existence.
Anti-User Enumeration Protection: Microsoft Entra does intentionally prevent revealing whether an account exists to mitigate user enumeration attacks. This means that if a user enters an unregistered email, the system will not provide specific feedback indicating that the account does not exist.
Advanced Control with Custom Policies: If you require advanced control, such as domain-based routing and preconditions, you would need to use Azure AD B2C with custom policies. The built-in user flows are limited in this regard and do not support such detailed customization.
Password Reset Behavior: For password reset scenarios, if a user clicks “Forgot password,” the system will send a reset link or OTP only if the account exists. However, the flow does not provide feedback about the existence of the account prior to this point.

In summary, while you can enable self-service password reset and MFA, the built-in user flows do not support the level of customization you are looking for regarding user experience for unknown email addresses. For more tailored experiences, consider using Azure AD B2C with custom policies.

References: