Azure AD B2C can not receive OTP (AIS providor)

OTP delivery to specific carriers (such as AIS) relies on external telecom networks, so issues often occur after Microsoft successfully hands off the SMS/voice request to a provider.

Use the following steps to investigate and mitigate:

1. Confirm OTP method and alternatives
   • If users have other verification options configured (for example, authenticator app/TOTP or another phone), instruct them to select Other verification options on the sign-in screen and test those methods. This helps confirm the issue is specific to SMS/voice for AIS.
   • Consider enabling and promoting authenticator app (TOTP) as a more reliable and secure method than SMS/phone for Azure AD B2C users. Authenticator app (TOTP) provides stronger security than SMS/Phone multifactor authentication.
2. Verify user phone configuration
   • Ensure the affected AIS numbers are correctly configured in user security verification settings (correct country/region code and number, no VOIP numbers).
   • Have another admin (if available) confirm the phone numbers in the user profile and verify that Block sign in is not enabled for those users.
3. Check for general SMS/voice issues
   • Validate that OTPs are delivered successfully to non-AIS numbers. If all carriers fail, the issue may be broader than AIS.
   • For AIS numbers, confirm that the devices can receive other SMS/voice calls and that there is no device-level blocking (e.g., spam filters, call/SMS blocking, or Do Not Disturb).
4. Understand where the failure may occur
   • When an SMS or voice MFA challenge is triggered, Microsoft Entra:
     1. Receives the request and constructs the SMS/voice payload.
     2. Sends it to an external telecom provider based on the country code.
     3. Routes via the correct channel (SMS or voice).
     4. Receives confirmation from the provider that the message was delivered to the telecom network.
   • After step 4, the request is in external telecom networks (including AIS and its upstream carriers). Microsoft no longer has direct visibility. Failures at this stage can be due to:
     • Carrier-level blocking or filtering.
     • Regional availability issues.
     • Device-level blocking or routing to voicemail.
5. Collect evidence for support
   • Gather:
     • Affected AIS phone numbers (masked where appropriate for privacy).
     • Country/region of the AIS numbers.
     • Approximate timestamps and correlation IDs (if available) for failed OTP attempts.
     • Confirmation that OTPs work for other carriers.
6. Open a Microsoft support ticket
   • Because issues with a specific carrier (AIS) often require coordination with telecom providers, open a support ticket so Microsoft can investigate the SMS/voice journey with its providers.
   • In the Azure portal:
     1. Sign in to the Azure portal.
     2. Switch to the Microsoft Entra tenant (not the B2C tenant) via Directories + subscriptions.
     3. Search for and select Microsoft Entra ID.
     4. Under Troubleshooting + Support, select New support request.
     5. Set Issue type to Technical, choose the subscription, and set Service type to Azure Active Directory Business to Consumer (B2C).
     6. Provide a concise summary and select the appropriate Problem type.
     7. On Additional details, include tenant ID, dates/times of failed OTPs, affected AIS numbers, and that the issue is specific to AIS.
   • Support can then trace the MFA requests up to the telecom provider and work with them if AIS or downstream carriers are dropping or altering messages.
7. Plan for resilience
   • Encourage users to register multiple MFA methods (authenticator app, backup phone, etc.) to avoid being blocked when a specific carrier has issues.
   • Monitor phone-based MFA failures using Azure Monitor and Log Analytics to detect patterns (for example, spikes in failures for AIS numbers) and respond quickly.

References:

• Troubleshoot MFA voice call and SMS problems
• The journey of an SMS or voice MFA request
• You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
• Secure phone-based multifactor authentication
• Find help and open a support ticket for Azure Active Directory B2C