Combined TOTP vs SMS vs Call MFA option on the B2C application

Question

I tested the following sample: https://github.com/azure-ad-b2c/samples/tree/master/policies/pwd-reset-via-email-or-phone

and I can see below result:

However, I want to add the TOTP option to this page. I tried using the following sample but it is not giving me the expected result. Any inputs?

https://learn.microsoft.com/en-us/azure/active-directory-b2c/multi-factor-authentication?pivots=b2c-user-flow

Answer 1

Please note that, you can select only one authentication method while enabling MFA.

In your scenario, you can select either TOTP or SMS/call as authentication method but not both.

I tried to reproduce the same in my environment and got the below results:

When I selected authentication method as SMS or phone call, user is prompted for MFA like below:

To enable TOTP option, update the user flow by changing authentication method like below:

When the user ran the user flow, it prompted for MFA to scan QR code like below:

After clicking Continue, they will get OTP in their Microsoft Authenticator app where they need to enter that code here:

Like this, you can enable TOTP as MFA method. But you cannot add this with SMS or Phone call as you can chose only one authentication method.

Answer 2

keep in mind that user flows has very limited options to customize, therefore this one that you want is not available. You need a custom policy for that, more complicated, yes but there are plenty options to customize and plenty workarounds if Azure doesn't offer you what you need.