External ID: TOTP (Authenticator) registration not offered, ...

Title: External ID: TOTP (Authenticator) registration not offered, "An additional verification method is required"

In our external tenant, TOTP registration is never offered to customers when MFA is required.

Setup (per "Add MFA to a customer app" docs, updated 2026-11-04):

• Microsoft Authenticator enabled for all users, "Allow use of Microsoft Authenticator OTP" = Yes
• Software OATH tokens enabled for all users
• Email OTP excluded for the test group, SMS disabled
• Conditional Access: test group, All resources, Require MFA, On (Security defaults disabled)
• User flow: Email with password, app added to the flow

Result: after email + password on the hosted sign-in page, no QR code is shown; sign-in ends with

"We couldn't sign you in - An additional verification method is required" (AADSTS50076).

Same for an existing user and a newly self-signed-up user. With Email OTP enabled, MFA works via email.

Is TOTP registration already rolled out to all external tenants? Is any extra setting required?