Entra External ID: OTP Verify button hangs indefinitely when invalid or empty code is submitted

Question

Entra External ID: OTP Verify button hangs indefinitely when invalid or empty code is submitted

Longlands, Dylan 0

On the OTP from Email verification page, clicking the "Verify" button with either an empty input or non-numeric characters causes the button to enter a permanent loading state with no error message shown and no way to recover without refreshing the page.

Steps to reproduce:

Trigger an OTP flow (e.g. sign-in with email OTP)
On the OTP entry page, either leave the field empty or enter non-numeric characters
Click the "Verify" button
Observe the form enters a loading state indefinitely
No error message is shown — page must be refreshed, or back button in browser hit, to recover

Expected: Immediate validation error, button remains interactive

Actual: Button hangs in loading state with no feedback

VEMULA SRISAI 11,330 Reputation points Microsoft External Staff Moderator

2026-04-08T15:38:30.5166667+00:00

Hello Longlands, Dylan,

When using Email OTP verification, the Verify action expects a valid numeric code. If the field is submitted empty or with non‑numeric characters, the page does not handle the input correctly and becomes unresponsive.

To avoid this behavior, ensure that a valid numeric OTP is entered before clicking Verify. If the page becomes stuck, refreshing the page or restarting the sign‑in flow allows the process to continue.

For better control and validation, implementing a custom sign‑in experience or custom authentication flow allows input checks (required field and numeric validation) before verification, preventing this scenario altogether.
Longlands, Dylan 0 Reputation points

2026-04-09T14:49:16.55+00:00

@VEMULA SRISAI Hi,

I understand how the form is supposed to function in terms of what it expects. The problem is that the unhappy path is completely overlooked by Microsoft in this case.

There should be better client side validation on this form to make sure that if the user accidentally clicks 'Verify' before entering a code, that they receive the correct feedback instead of the form being stuck in a loading state.

I also understand that custom flows, if possible for this page, could alleviate these issues, but the underlying problem is that the behaviour should be more user friendly out of the box, and not require custom development injection for basic UX features.

1 answer

Your answer

VEMULA SRISAI 11,330 Reputation points Microsoft External Staff Moderator

2026-04-08T15:38:30.5166667+00:00

Hello Longlands, Dylan,

When using Email OTP verification, the Verify action expects a valid numeric code. If the field is submitted empty or with non‑numeric characters, the page does not handle the input correctly and becomes unresponsive.

To avoid this behavior, ensure that a valid numeric OTP is entered before clicking Verify. If the page becomes stuck, refreshing the page or restarting the sign‑in flow allows the process to continue.

For better control and validation, implementing a custom sign‑in experience or custom authentication flow allows input checks (required field and numeric validation) before verification, preventing this scenario altogether.
Longlands, Dylan 0 Reputation points

2026-04-09T14:49:16.55+00:00

@VEMULA SRISAI Hi,

I understand how the form is supposed to function in terms of what it expects. The problem is that the unhappy path is completely overlooked by Microsoft in this case.

There should be better client side validation on this form to make sure that if the user accidentally clicks 'Verify' before entering a code, that they receive the correct feedback instead of the form being stuck in a loading state.

I also understand that custom flows, if possible for this page, could alleviate these issues, but the underlying problem is that the behaviour should be more user friendly out of the box, and not require custom development injection for basic UX features.

Answer 1

The described behavior indicates a client-side validation or error-handling bug in the OTP verification page for Entra External ID email OTP flows. The expected behavior (inline validation and keeping the button interactive) is not configurable from the available documentation and is not covered by the referenced troubleshooting guidance.

From the provided context, the only supported guidance around OTP-related failures is:

OTP-related sign-up/sign-in errors are surfaced as error codes (for example, 50181 for “Unable to validate the OTP” and 1002027 for “Some of the collected attributes were invalid”). These are intended to be handled by the application or UX layer and remediated by the user (for example, requesting a new OTP or re-entering attributes).
For persistent issues that are not resolved by the documented remediation steps, the supported path is to open a support request with Microsoft Entra support.

Because the issue here is a UX hang with no error surfaced and no documented configuration or workaround in the provided material, the appropriate action is to:

Collect details for support
- Tenant type and configuration (External ID / B2C or CIAM tenant, user flow or custom policy in use).
- Exact flow (for example, email OTP sign-in, sign-up, or recovery email verification) and whether it is a built-in page or a custom page.
- Timestamp, correlation_id, and trace_id from the failing request if available (these are explicitly called out as diagnostic fields for sign-up/native auth errors).
- Browser and device details, and whether the issue reproduces across different browsers or networks.
Open a Microsoft Entra support request
- Use the Entra support channel described in the sign-up troubleshooting article to report this as a product issue/bug, including the reproduction steps and diagnostics above.

If this behavior is occurring inside a custom client that calls the native authentication APIs directly, the client should:

Inspect the error, error_description, and error_codes fields in the response when an invalid or empty OTP is submitted.
Ensure the UI does not stay in a loading state when an error is returned, and instead shows a validation message and re-enables the Verify button.

References:

Share via

Entra External ID: OTP Verify button hangs indefinitely when invalid or empty code is submitted

1 answer

Your answer