External ID in an external tenant: How to register multiple MFA methods

Question

External ID in an external tenant: How to register multiple MFA methods

TU2 10

I uses the native authentication in my SPA app. When users encounter the AuthMethodRegistrationRequiredState during login, they can use the following process to register an MFA method.

AuthMethodRegistrationRequiredState.challengeAuthMethodAuthMethodVerificationRequiredState.submitChallengeAuthMethodRegistrationCompletedState

The user is already logged in at this point. My question is: how to register an additional MFA method after login?

Rukmini 41,995 Reputation points Microsoft External Staff Moderator

2026-05-27T14:08:10.1666667+00:00

Hello @TU2

The Native Authentication challenge flow does not yet allow for the registration of additional MFA methods once the user has logged in.

Hence: * Take the user to the Microsoft My Security Info website: https://mysignins.microsoft.com/security-info?) Additional MFA methods, such as the Authenticator app, phone, FIDO2, etc., can be added or managed by the user.
TU2 10 Reputation points

2026-05-27T14:19:56.02+00:00

Hello @Rukmini

How to pass a token when a logged-in external user accesses https://mysignins.microsoft.com/security-info
Rukmini 41,995 Reputation points Microsoft External Staff Moderator

2026-05-28T11:39:16.7666667+00:00

Hello @TU2

When using the Security Info portal, the logged-in external user must interactively authenticate against the tenant; you do not manually give the token to https://mysignins.microsoft.com/security-info.

The sign-in process may be silent if SSO session cookies are already in place. Please be aware, however, that native authentication situations and External ID customer tenants may have different levels of support for controlling MFA techniques through the My Security Info portal.

Currently, post-login MFA method administration is still restricted, and native authentication primarily enables MFA registration during the challenge sequence itself.
TU2 10 Reputation points

2026-05-28T13:25:55.06+00:00

@Rukmini Is the solution(/register/v1.0/continue) provided in the AI's answer feasible?
Rukmini 41,995 Reputation points Microsoft External Staff Moderator

2026-05-28T13:29:13.79+00:00

Hello @TU2 Yes you can try it !
TU2 10 Reputation points

2026-05-28T13:44:37.9633333+00:00

@Rukmini Is there any documentation about /register/v1.0/continue? How should the continuation_token parameter be generated?
Rukmini 41,995 Reputation points Microsoft External Staff Moderator

2026-05-29T09:53:05.28+00:00

@TU2

The supported approach today is to use the native authentication challenge flow for MFA registration during sign-in.
Rukmini 41,995 Reputation points Microsoft External Staff Moderator

2026-06-01T17:15:50.95+00:00

Hello @TU2

Following up to see if the above provided information was helpful. If you have any further queries do let us know.

1 answer

Your answer

Rukmini 41,995 Reputation points Microsoft External Staff Moderator

2026-05-27T14:08:10.1666667+00:00

Hello @TU2

The Native Authentication challenge flow does not yet allow for the registration of additional MFA methods once the user has logged in.

Hence: * Take the user to the Microsoft My Security Info website: https://mysignins.microsoft.com/security-info?) Additional MFA methods, such as the Authenticator app, phone, FIDO2, etc., can be added or managed by the user.
TU2 10 Reputation points

2026-05-27T14:19:56.02+00:00

Hello @Rukmini

How to pass a token when a logged-in external user accesses https://mysignins.microsoft.com/security-info
Rukmini 41,995 Reputation points Microsoft External Staff Moderator

2026-05-28T11:39:16.7666667+00:00

Hello @TU2

When using the Security Info portal, the logged-in external user must interactively authenticate against the tenant; you do not manually give the token to https://mysignins.microsoft.com/security-info.

The sign-in process may be silent if SSO session cookies are already in place. Please be aware, however, that native authentication situations and External ID customer tenants may have different levels of support for controlling MFA techniques through the My Security Info portal.

Currently, post-login MFA method administration is still restricted, and native authentication primarily enables MFA registration during the challenge sequence itself.
TU2 10 Reputation points

2026-05-28T13:25:55.06+00:00

@Rukmini Is the solution(/register/v1.0/continue) provided in the AI's answer feasible?
Rukmini 41,995 Reputation points Microsoft External Staff Moderator

2026-05-28T13:29:13.79+00:00

Hello @TU2 Yes you can try it !
TU2 10 Reputation points

2026-05-28T13:44:37.9633333+00:00

@Rukmini Is there any documentation about /register/v1.0/continue? How should the continuation_token parameter be generated?
Rukmini 41,995 Reputation points Microsoft External Staff Moderator

2026-05-29T09:53:05.28+00:00

@TU2

The supported approach today is to use the native authentication challenge flow for MFA registration during sign-in.
Rukmini 41,995 Reputation points Microsoft External Staff Moderator

2026-06-01T17:15:50.95+00:00

Hello @TU2

Following up to see if the above provided information was helpful. If you have any further queries do let us know.

Answer 1

For native authentication in an External ID (CIAM) tenant, registering a strong/MFA method is always driven by the native auth flows and APIs. At least one strong authentication method (email or SMS one-time passcode) is required for MFA-enabled users, but additional methods can also be registered by invoking the same “strong authentication method registration” flow again after sign-in.

Conceptually, registering an additional MFA method after the user is already signed in works the same way as when AuthMethodRegistrationRequiredState is triggered during sign-in:

Start a strong authentication method registration flow from the signed-in session (client-side UX decision).
Call the native authentication register strong authentication method APIs.
Complete the challenge with /register/v1.0/continue using the OTP from the new email/phone.
On success, the new method is added to the user’s registered strong methods and becomes available for MFA challenges.

From the API perspective, the key step for completing registration is the continue call:

POST https://{tenant_subdomain}.ciamlogin.com/{tenant_subdomain}.onmicrosoft.com/register/v1.0/continue
  ?continuation_token=...
  &client_id=...
  &grant_type=oob
  &oob={otp_code}

To support registering additional methods after login in a SPA:

Ensure the app is configured with the strong authentication method registration capabilities (as in the Angular/React tutorials).
Provide a “Manage security / Add MFA method” page in the SPA that:
- Uses the native auth JS SDK to initiate a register-strong-method flow for the signed-in user (email or SMS OTP).
- Guides the user through entering the new email/phone and verifying the OTP.
Handle registration errors (for example, provider_blocked_by_admin or provider_blocked_by_rep) as documented in the native auth API reference.

In other words, to add another MFA method after login, invoke the same strong authentication registration flow (via native auth SDK + /register endpoints) from an authenticated context instead of waiting for AuthMethodRegistrationRequiredState during sign-in.

References:

Share via

External ID in an external tenant: How to register multiple MFA methods

1 answer

Your answer