Common Auth API to collect MFA phone number

Question

Common Auth API to collect MFA phone number

Sauvik Chatterjee 0

Hello MS Team,

We are exploring the possibility of leveraging the MFA phone number stored in Azure AD B2C as an additional authentication factor within our application.

Could you please help us understand how the Common Auth API works in this scenario? Specifically:

How does the API retrieve or access the MFA phone number information?
Are there any prerequisites, limitations, or security considerations that we should be aware of?

We previously evaluated retrieving the MFA phone number directly from Azure AD B2C and concluded that the number used for MFA is not externally accessible without significant changes to the existing implementation. Given that understanding, we would appreciate any additional details on how the Common Auth API addresses this challenge and what level of effort would be required from our side.

kagiyama yutaka 4,835 Reputation points

2026-07-08T14:12:05.25+00:00

B2C does not expose the MFA phone number through Common Auth API, and the practical way to use a phone factor in ur app is to add a separate phone attribute in the user profile and let the user register that number for your own flow.
Harshitha Eligeti 4,525 Reputation points Microsoft External Staff Moderator

2026-08-06T21:38:08.64+00:00

Hello @Sauvik Chatterjee
Thank you for reaching out.

The MFA phone number used by Azure AD B2C is managed as part of the authentication service and is not exposed to applications through the Common Auth API. As a result, applications cannot retrieve or access the phone number that a user has registered for MFA purposes.

From a security and privacy perspective, Azure AD B2C is designed to handle MFA verification internally without exposing authentication factors to external applications.

If your application requires access to a phone number for additional authentication or business logic, the recommended approach is to maintain a separate phone number attribute in the user's profile and implement your own registration and verification flow. This phone number can then be used independently of the MFA phone number managed by Azure AD B2C.

Therefore, the Common Auth API does not provide a mechanism to retrieve the MFA phone number, nor does it offer a workaround for accessing that information.

I hope this helps clarify the behavior. Please let us know if you have any further questions.‌

Your answer

kagiyama yutaka 4,835 Reputation points

2026-07-08T14:12:05.25+00:00

B2C does not expose the MFA phone number through Common Auth API, and the practical way to use a phone factor in ur app is to add a separate phone attribute in the user profile and let the user register that number for your own flow.
Harshitha Eligeti 4,525 Reputation points Microsoft External Staff Moderator

2026-08-06T21:38:08.64+00:00

Hello @Sauvik Chatterjee
Thank you for reaching out.

The MFA phone number used by Azure AD B2C is managed as part of the authentication service and is not exposed to applications through the Common Auth API. As a result, applications cannot retrieve or access the phone number that a user has registered for MFA purposes.

From a security and privacy perspective, Azure AD B2C is designed to handle MFA verification internally without exposing authentication factors to external applications.

If your application requires access to a phone number for additional authentication or business logic, the recommended approach is to maintain a separate phone number attribute in the user's profile and implement your own registration and verification flow. This phone number can then be used independently of the MFA phone number managed by Azure AD B2C.

Therefore, the Common Auth API does not provide a mechanism to retrieve the MFA phone number, nor does it offer a workaround for accessing that information.

I hope this helps clarify the behavior. Please let us know if you have any further questions.‌