Is "Remember MFA on trusted device" supported for external tenant accounts created through a user flow?

Question

Is "Remember MFA on trusted device" supported for external tenant accounts created through a user flow?

Aaron-0171 0

Here's the scenario I'm wondering about:

I have setup an external tenant with Entra External ID.
I have a sign-in / sign-up user flow created and associated with a .NET core application.
A conditional access policy is setup to require MFA for all users during sign-in.
Through the user flow I have registered new users (local accounts) that use either email OTP or SMS for multi-factor authentication.
Every time I sign-in with these accounts through the user flow, I am prompted for MFA.

Is there a way to remember MFA on trusted devices for this scenario?

I have tried enabling the following setting found under "Users > Per-user MFA > Service settings" but there was no change in the user flow. This seems like a global setting, but it's unclear if it only applies to users that have been setup with MFA through the Per-user MFA screen or other account types.

User's image

1 answer

Your answer

Answer 1

Hello Aaron-0171,

The "Remember multi-factor authentication on trusted devices" feature is supported in both Microsoft Entra External ID and Azure AD B2C tenants. To confirm this, I performed a quick test in my own External ID tenant by enabling the "Remember multi-factor authentication on trusted devices" option for 7 days using the Per-user MFA service settings. Please refer to the screenshot below.

User's image

After enabling this setting, all users in my tenant were able to see the option on the login screen to remember the device for the number of days specified. User's image

I conducted the test using a regular user in the tenant—not a local or guest (B2B) account.

It's important to note that this feature is not compatible with B2B users. The option will not appear for B2B users signing into invited tenants. In other words, if a user's identity is managed by an external identity provider rather than your own tenant, this feature will not be available. Reference: Remember multi-factor authentication – how the feature works.

User's image To summarize:

The feature is supported in both Entra External ID and Azure AD B2C tenants.
It only works for users who are created in the same tenant.
It does not work for B2B users signing into an external tenant.

Any local account created within your tenant will be managed under External Identities. One key observation is that the User Principal Name (UPN) format will vary between local accounts and internal users.

To help illustrate this, I'm attaching a screenshot from my demo tenant, which contains four different types of users:

User's image To help illustrate this, I'm attaching a screenshot from my demo tenant, which contains four different types of users:

CIAM Admin User – This user was created directly in my External ID (CIAM) tenant. As expected, the identity uses the format CIAMDomain.onmicrosoft.com since it is natively managed within the CIAM directory.
Hari – This user was created from the Azure portal using the "Create new external user" option. I provided a personal Microsoft account email address, so the authentication is handled by the personal Microsoft account system.

The key point here is that the UPN appears in the format ******@CIAMDomain.onmicrosoft.com, indicating that the user identity is managed externally and not natively within the CIAM tenant.
Signup Flow User – This account was created using a sign-up user flow, which also results in the user being managed by an external identity provider.
Guest User – This user was invited from another tenant. Guest user identities will always show ExternalAzureAD as their source, indicating that they reside in a different directory.

So, to summarize: Local account identities are always managed by their respective identity providers (like personal Microsoft accounts, social IDPs, etc.)—not directly by your CIAM tenant.

I hope this information is helpful. Please feel free to reach out if you have any further questions. For a more detailed explanation with an example, please refer to the following Q&A post which discusses a similar scenario.

https://learn.microsoft.com/en-us/answers/questions/2265280/does-entra-external-tenant-support-trusted-device

Aaron-0171 0 Reputation points

2025-07-10T15:31:11.82+00:00

Thank you for the response, but it's not clear if this answers my question.

The account you show it working for (ciamadmin) is different from the account created through my scenario.

My scenario would be a customer registering and signing-in through the user flow. I believe this is similar to #3 (display name "unknown") from your screenshot of the different account types. You say this user is managed by their external identity provider, but in my case wouldn't External ID (entra) be the identity provider? I'm not signing in using google, microsoft, etc.
Raja Pothuraju 24,290 Reputation points Microsoft External Staff Moderator

2025-07-11T08:19:46.5633333+00:00

Aaron-0171, Apologies for any confusion caused.

In a Microsoft Entra External tenant (CIAM), most applications are designed to let users sign in with any arbitrary email address — for example, ******@comcast.net, ******@gmail.com, ******@contoso.com, or ******@live.com. Accounts created this way are considered local accounts, not work or school accounts, in a CIAM tenant.

Because these users were signed up through user flows, they are created as local accounts in the tenant rather than as standard directory users.

In short, local accounts are not compatible with this feature. It is only supported for standard users that are created directly within the tenant and not via user flows.
Aaron-0171 0 Reputation points

2025-07-11T11:53:36.5766667+00:00

Thank you Raja, that answer was clear. I have one last question: was there anywhere in the documentation that mentions local accounts are not compatible with this feature or are they considered B2B users (even though I'm using it in a B2C context) which was mentioned as not being compatible in your screenshot above?

Share via

Is "Remember MFA on trusted device" supported for external tenant accounts created through a user flow?

1 answer

Your answer