Azure AD B2C: AADB2C90273 nonce validation fails for specific Microsoft accounts

We are experiencing an issue when users select "Sign in with Microsoft" on our Azure AD B2C SSO page, which uses OpenID Connect to authenticate against the Microsoft Identity Platform (Microsoft Account/Entra ID).

The issue occurs for some of the users with Microsoft accounts (observed with some @outlook.com accounts). The same Azure AD B2C configuration and sign-in flow work successfully for other Microsoft accounts.

The authentication fails with the following error:

AADB2C90273: An invalid response was received:
'Error: invalid_request, Error Description:
The provided 'nonce' parameter contains invalid characters or exceeds the maximum allowed length.'

Environment

• Azure AD B2C Custom Policies (Identity Experience Framework)
• OpenID Connect federation
• Microsoft Identity Platform (login.microsoftonline.com/common/v2.0)
• Response type: id_token
• Response mode: form_post
• Scope: openid profile email

What we've verified

• The issue reproduces consistently for the same @outlook.com account across multiple Azure AD B2C tenants.
• Other Microsoft accounts (including other @outlook.com accounts) authenticate successfully using the exact same custom policy.
• The nonce is generated entirely by Azure AD B2C and is not modified anywhere in our custom policy.
• The error occurs before authentication completes.
• We tested across multiple browsers, private browsing sessions, different machines, and after clearing cookies/cache, with the same result.
• The nonce appears to be a standard Base64 value (for example ending with ==) and is URL-encoded by Azure AD B2C before being sent to the Microsoft Identity endpoint.
• Since the same account fails across different Azure AD B2C tenants, we suspect the issue is not tenant- or policy-specific.

Questions

Has anyone encountered this issue before?

• Can Microsoft Identity reject a nonce generated by Azure AD B2C for only certain Microsoft accounts?
• Is there any known issue with Base64-encoded nonce values containing characters such as +, /, or trailing =?
• Are there any Microsoft Identity service-side validations that could trigger this error for only a subset of Microsoft accounts?
• Has anyone successfully resolved this issue, or did it require assistance from the Microsoft Identity/Entra engineering team?

Any guidance or similar experiences would be greatly appreciated.