Entra External ID — MFA email verification codes intermittently undelivered or severely delayed (two tenants)

Question

Entra External ID — MFA email verification codes intermittently undelivered or severely delayed (two tenants)

ContinuoCare 0

Microsoft Entra External ID (external/CIAM tenants), email verification code as the

MFA second factor. Built-in Microsoft email provider, no custom provider configured.

AFFECTED TENANTS — BOTH, independently configured

Linked subscription for both: [Moderator note: Personally Identifiable Information removed]

SYMPTOM

Users authenticate successfully with their password, are challenged for the email verification code required by Conditional Access, and the code either never arrives or arrives after a delay long enough that it has already expired.

Delivery is INTERMITTENT, not a clean failure: a minority of codes do arrive, heavily

delayed. The majority never arrive at all. The sign-in UI reports "We emailed a code to

<address>" in every case, successful or not.

Recipients across gmail.com and corporate domains are equally affected, which excludes recipient-side filtering.

IMPACT

End users are locked out of the production application. Staging is equally affected, so we cannot validate a fix.

ONSET

Last known good production sign-ins: 2026-11-12 15:57Z, 18:35Z, 18:37Z.

Failures reported from 2026-11-13 onward in both tenants.

0 comments

2 answers

Your answer

Answer 1

Hi @ContinuoCare

Based on the timing and symptoms described, this issue may be related to the ongoing Microsoft 365 service incident, which has affected multiple Microsoft 365 services, including Exchange Online. I recommend monitoring Microsoft 365 Admin Center – Service Health (MO1550821)

The fact that recipients using both Gmail and corporate email domains are experiencing similar delivery problems makes an issue with individual recipient mail servers or email filtering less likely. Combined with the simultaneous impact across two independently configured Entra External ID tenants, this raises the possibility of a service-side issue with Microsoft's email verification code delivery infrastructure.

Therefore, I strongly recommend raising a support ticket through the Microsoft 365 admin center so Microsoft's support team can investigate the email OTP delivery issue specifically and confirm whether it is related to the ongoing incident.

Please note that this is a user-to-user support forum. We cannot access your tenant's service diagnostics or create a support ticket on your behalf.

Hopefully, this will be resolved once the underlying service disruption is addressed.

Answer 2

Check tenant-scoped Azure Service Health now and open a Microsoft Entra support incident with fresh correlation IDs from both tenants; the simultaneous onset and built-in-provider failures warrant service-side investigation rather than reconfiguring two independent tenants.

1. Check tenant-scoped service health

The public Azure status page reports broad incidents and may not expose tenant-specific impact. For the subscription linked to both external tenants:

In the Azure portal, open Service Health → Service issues.
Filter for the affected subscription and identity/MFA-related services.
Open any matching event and record its:
- Tracking ID
- Start time
- Scope
- Current mitigation guidance
Also open Service Health → Health history and search the period beginning 2026-11-13. Active and resolved service issues remain visible in the portal for 90 days. ^1^ ^2^

If a matching issue appears, use its Create a support request action when production remains blocked or tenant impact is not accurately represented. If no issue appears, Microsoft explicitly recommends opening a ticket for persistent impact not reflected in Service Health. ^3^

2. Capture fresh evidence from both tenants

For several failed attempts and at least one delayed delivery:

Open the external tenant in the Microsoft Entra admin center.
Go to Entra ID → Monitoring & health → Sign-in logs.
Filter by:
- Affected user
- Application
- Date and UTC time
- Failure or interrupted status
Open each event and record:
- Tenant
- Correlation ID
- UTC timestamp
- Application ID/name
- Sign-in error code and failure reason
- Authentication Details result
- Conditional Access policy that required MFA
Repeat in the second tenant.

Sign-in logs show whether MFA was challenged, which method was used, and why the authentication step failed or remained incomplete. ^4^

Use samples from the last 48 hours where possible. Correlation IDs let Microsoft locate the related backend telemetry, while exact UTC timestamps distinguish “message requested but not delivered” from “message delivered after expiry.” ^5^

Also run the diagnostic against representative events:

From a sign-in event, select Launch the Sign-in diagnostic; or
Open Diagnose & solve problems → Sign-in Diagnostic → Troubleshoot.
Search by user, application, correlation ID, and time.

Using diagnostics from sign-in logs requires at least Reports Reader. ^6^

3. Open the support incident

In the Microsoft Entra admin center, sign in with at least Service Support Administrator, create a support request, and use the closest available classification:

Service type: Microsoft Entra Sign-in and multifactor authentication
Problem type: Multifactor authentication
Problem subtype: Unable to sign in to an application due to MFA

Include:

Production outage and staging impact
Exact onset and last-known-good UTC timestamps
Confirmation that both are External ID external tenants
Built-in Microsoft email provider; no custom email provider
Same behavior across consumer and corporate recipient domains
Several fresh correlation IDs and timestamps from each tenant
Examples that never arrived and examples arriving after expiry
Relevant Service Health tracking ID, or explicitly state that no matching tenant-scoped event is shown
A request to inspect email OTP generation, enqueueing, and delivery telemetry for both tenant scopes

Microsoft Support can access tenant configuration, sign-in/audit logs, and service-health telemetry when investigating an Entra incident. ^7^ The documented support flow allows logs and diagnostic output to be attached to the request. ^8^

Supported behavior and temporary mitigation

Email one-time passcode is supported as an MFA second factor when the local first factor is Email with password, and users must complete verification within 10 minutes. The reported delays beyond that window therefore make delivered codes unusable. ^9^

For continuity, use another already-enabled and already-registered method where available:

SMS, which is a paid add-on requiring a linked subscription.
Passkey (FIDO2) for eligible local-account users.
TOTP only after it is available in the tenant; the documented rollout begins at the end of November 2026 and completes in early December 2026.

Do not depend on newly registering a replacement method during the outage if registration itself requires the unavailable MFA challenge. Avoid weakening the production Conditional Access policy globally; any emergency exclusion should be narrowly scoped, time-limited, monitored, and removed once delivery recovers.

References