AADSTS1100001 - Entra External ID Custom One Time Passcode Emails

AADSTS1100001 with underlying error 1003002 during /resetpassword/v1.0/challenge indicates that the email OTP send pipeline is failing in the custom extension path and Entra is treating it as a non‑retryable error. In the custom Email OTP scenario this typically means the OnOtpSend custom authentication extension or its backing Azure Function is misconfigured or returning an unexpected response.

For the second environment, validate the following pieces end‑to‑end against the working QA setup:

1. Confirm the custom authentication extension is correctly registered
   • In Microsoft Entra ID → Enterprise applications → Custom authentication extensions, open the extension used for Email OTP.
   • Ensure the Event type is EmailOtpSend.
   • Verify the Target URL exactly matches the Azure Function URL for this dev environment (including function name and system key) as described in Step 3 of the guide.
   • Check that the correct application(s) are selected on the Applications tab so that the reset‑password flow for this tenant/app actually invokes this extension.
2. Verify API authentication wiring
   • In the extension’s API Authentication configuration, confirm that the app registration selected is the one created for this dev environment’s function app (for example, Azure Functions authentication events API for this environment), not the QA one.
   • In the Azure Function → Authentication, confirm that the same app registration is configured as the identity provider, following Step 5:
     • Identity provider is Microsoft (or OpenID Connect if the function is in a different tenant).
     • App registration is set to the dev environment’s Azure Functions authentication events API.
     • Unauthenticated requests is set to HTTP 401 Unauthorized.
3. Check OpenID Connect settings (if using OIDC instead of Microsoft provider)
   • In the Function’s Authentication → identity provider configuration, verify:
     • Document URL uses the correct tenant name and ID for this dev environment:

              https://{tenantname}.ciamlogin.com/{tenantId}/v2.0/.well-known/openid-configuration
       

     • App registration (client ID) is the dev environment’s Azure Functions authentication events API app ID.
     • The Client secret matches a valid secret created under that app registration’s Certificates & secrets.
4. Validate the Function’s token validation and response
   • Ensure the function is actually receiving the call from Entra and successfully validating the incoming bearer token using the dev environment’s app registration.
   • Confirm the function returns HTTP 200 with the exact JSON structure required for Email OTP send events, as described in the Email OTP send event reference:

          {
            "data": {
              "@odata.type": "microsoft.graph.OnOtpSendResponseData",
              "actions": [
                {
                  "@odata.type": "microsoft.graph.OtpSend.continueWithDefaultBehavior"
                }
              ]
            }
          }
     

   • Any deviation (wrong @odata.type, missing data wrapper, non‑200 status, or exception) will cause the event to fail and can surface as AADSTS1100001.
5. Test the extension independently
   • Use the Email OTP send event reference to simulate the HTTP POST that Entra sends to the function (same URL and payload shape) and verify that the function:
     • Accepts the request.
     • Sends the email via the provider.
     • Returns the correct success response above.
6. Enable fallback to Microsoft provider (optional for isolation)
   • To distinguish between extension failures and core service issues, configure the listener to fall back to the Microsoft provider on error as shown in Step 7:
     • Use Microsoft Graph PATCH on identity/authenticationEventListeners/{customListenerObjectId} with:

              "behaviorOnError": {
                "@odata.type": "#microsoft.graph.fallbackToMicrosoftProviderOnError"
              }
       

   • If the flow then succeeds using the Microsoft provider, the issue is confirmed to be in the custom extension or function configuration.
7. Cross‑check app registrations and tenant
   • Ensure that:
     • The reset‑password client app, the custom authentication extension, and the Azure Functions authentication events API app registration are all created in the same external tenant (unless intentionally using the cross‑tenant OIDC pattern in Step 5.1).
     • No IDs, secrets, or URLs from the QA environment were reused in the dev environment configuration.

By systematically comparing these items with the known‑good QA setup, the usual root cause is a mismatch in the function URL, app registration (client ID/secret), or the function’s response schema, any of which will cause the EmailOtpSend event to fail and surface as AADSTS1100001 during /resetpassword/v1.0/challenge.

References:

• Configure a custom email provider for one time passcode send events
• Email OTP send event reference
• Custom authentication extensions overview