Microsoft Entra External ID sign-up verification emails not received on Gmail or custom domains

Jhonnatan Correa 0 Reputation points
2026-10-20T02:49:34.0066667+00:00

Since October 19, 2026, users have been unable to complete sign-up in a Microsoft Entra External ID external tenant. The verification screen says a code has been sent, but the email does not arrive.

Configuration

  • External tenant for customers (CIAM), not B2B invitations.
  • Sign-up and sign-in user flow using Email with password.
  • The issue is email verification during account creation, not invitation emails sent by our application.
  • No custom authentication extensions were found configured.

Tests and observations

  1. Addresses at two custom domains and a Gmail address were tested. No code was received; the Gmail result was reported by the user.
  2. Resend code did not result in delivery.
  3. For one custom domain, we verified the mailbox exists, is not restricted and has available storage, and checked Inbox and Spam.
  4. The available cPanel delivery log shows no Microsoft message, rejection or deferral for that recipient. We cannot rule out filtering upstream of that server. We do not have Gmail or second-domain delivery traces.
  5. One attempt's troubleshooting panel shows Error Code 16000. We retained the request ID, correlation ID and exact timestamp for an official private support channel only.
  6. After attempting to enable sign-in error flagging, the UI still showed Enable flagging and an error. Filtering flagged attempts returned no records.
  7. A separate earlier attempt showed error 300001: "The user is required to verify a credential". We have not established that it relates to the current attempt or explains email non-delivery.
  8. Azure Service Health, with our subscription included and all services and regions selected, showed no active incidents or advisories. The last week's history also showed no events. This does not rule out an unreported issue.
  9. The portal's automated AI diagnostic suggested throttling or anti-abuse protection. This is only a hypothesis: we have no trace confirming a block or evidence that a limit was reached.
  10. We attempted to open a technical support request, but the portal required a paid support plan because we have Basic support. No ticket was created.

Questions

  • Which logs or tools can confirm whether Entra attempted to send the verification email, and whether it was suppressed, throttled or rejected?
  • How can we confirm or rule out a temporary verification restriction without disabling security controls?
  • Is there a known incident matching these symptoms?
  • Is there an official private escalation channel where a moderator or engineer can review attempt identifiers when only Basic support is available?

We have not changed authentication settings or purchased another plan. We would appreciate concrete diagnostic steps. Email addresses, domains, tenant and application identifiers, IP addresses and screenshots containing personal information are deliberately omitted from this public question.

Microsoft Security | Microsoft Entra | Microsoft Entra External ID
0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest
  1. Palanikumar Annamalai 160 Reputation points
    2026-10-20T08:58:58.3866667+00:00

    The fact that verification emails fail for both Gmail and custom domains makes a single recipient mailbox issue less likely, but it does not by itself prove that Microsoft has suppressed the sender. I would troubleshoot this from the External ID sign-up transaction first.

    1. In the external tenant, open Microsoft Entra ID > Monitoring & health > Sign-in logs, then filter for User sign-ups around the exact UTC test time.
    2. Save the request ID, correlation ID, timestamp, application, user flow and error code. Error 1002013 only means the sign-up flow prompted for email verification; 50181 indicates an invalid one-time passcode and 50182 an expired one.
    3. Confirm that the application is associated with the intended sign-up/sign-in user flow and that Email one-time passcode is enabled as the identity provider.
    4. Run one controlled test to each recipient domain, spaced several minutes apart. Ask the recipient administrator to run a message trace and check junk/quarantine. Avoid repeated resend attempts because they can make rate limiting harder to distinguish from delivery failure.
    5. If the sign-up log shows the verification step but no message arrives, open one Microsoft support case and provide the UTC timestamps plus request/correlation IDs privately. External ID does not expose the full outbound email delivery pipeline to customers.

    Do not post tenant IDs, email addresses or correlation data publicly.

    Official guidance:

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.