--- title: Remove sign-up from Entra External ID user flows | daily.dev description: Disabling the sign-up flow in Entra External ID user flows prevents bots from abusing SMS or phone verification to rack up tenant costs. A PowerShell script... canonical: https://daily.dev/posts/remove-sign-up-from-entra-external-id-user-flows-6yv1ippcd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Remove sign-up from Entra External ID user flows | daily.dev og:description: Disabling the sign-up flow in Entra External ID user flows prevents bots from abusing SMS or phone verification to rack up tenant costs. A PowerShell script... og:url: https://daily.dev/posts/remove-sign-up-from-entra-external-id-user-flows-6yv1ippcd og:image: https://api.daily.dev/og/posts/6Yv1ipPCD.png og:image:alt: Remove sign-up from Entra External ID user flows og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Remove sign-up from Entra External ID user flows **[Damien Bowden](https://daily.dev/sources/damienbod)** · 3 min read · 0 upvotes · 0 comments ## Summary Disabling the sign-up flow in Entra External ID user flows prevents bots from abusing SMS or phone verification to rack up tenant costs. A PowerShell script using Microsoft Graph (via an app registration with the EventListener.ReadWrite.All permission) sets isSignUpAllowed to false on the self-service sign-up event flow. The author recommends deleting the temporary app registration after running the script and argues that IAM systems should support passkeys or authenticator apps rather than relying on costly SMS/phone verification for unauthenticated flows. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I disable the sign-up flow in Entra External ID to stop SMS verification cost abuse? Use a PowerShell script with the Microsoft Graph Identity.SignIns module to update the self-service sign-up event flow and set isSignUpAllowed to false. The script requires an Azure App registration with the EventListener.ReadWrite.All Graph permission, plus the tenant ID, application client ID, and client secret, and queries Get-MgIdentityAuthenticationEventFlow to find the user flow before updating it. _Developers hardening Entra External ID against SMS-fraud bots can find similar identity configuration guidance on daily.dev._ ### Why would bots exploit SMS or phone verification in an identity sign-up flow? Bots can create accounts and trigger phone or SMS validation during unauthenticated sign-up flows purely to run up telecom charges billed to the tenant, since each verification attempt costs money regardless of whether an account is ever legitimately used. This is why SMS or phone verification should not be exposed in unauthenticated sign-up flows, and IAM systems should instead support passkeys or authenticator apps for MFA. _Teams designing sign-up and MFA flows can track identity security practices like this on daily.dev._ ## Similar posts on daily.dev - [Microsoft reminds admins to migrate Entra ID users to passkeys](https://daily.dev/posts/microsoft-reminds-admins-to-migrate-entra-id-users-to-passkeys-qkl8epwo1) · BleepingComputer · 0 upvotes · 0 comments - [\[HOWTO\] Delete users created by bots in Azure AD B2C](https://daily.dev/posts/howto-delete-users-created-by-bots-in-azure-ad-b2c-xqjf2yodn) · We Are .NET · 0 upvotes · 0 comments - [What Programmatic Onboarding Looks Like on Microsoft Entra ID](https://daily.dev/posts/what-programmatic-onboarding-looks-like-on-microsoft-entra-id-yeebm2yt4) · API Evangelist · 0 upvotes · 0 comments - [Microsoft to Block Unauthorized Scripts in Entra ID Logins with 2026 CSP Update](https://daily.dev/posts/microsoft-to-block-unauthorized-scripts-in-entra-id-logins-with-2026-csp-update-pojtlwoj9) · The Hacker News · 1 upvotes · 0 comments - [How I Stop Fake Signups From Farming Free Credits \(JS/Python\)](https://daily.dev/posts/how-i-stop-fake-signups-from-farming-free-credits-js-python--r9gwj3ryz) · Medium · 1 upvotes · 0 comments --- Tags: [#cloud](https://daily.dev/tags/cloud), [#microsoft](https://daily.dev/tags/microsoft), [#authentication](https://daily.dev/tags/authentication), [#powershell](https://daily.dev/tags/powershell) [View this post on daily.dev](https://daily.dev/posts/remove-sign-up-from-entra-external-id-user-flows-6yv1ippcd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Remove sign-up from Entra External ID user flows","url":"https://daily.dev/posts/remove-sign-up-from-entra-external-id-user-flows-6yv1ippcd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/remove-sign-up-from-entra-external-id-user-flows-6yv1ippcd"},"datePublished":"2026-10-04T13:04:06.372Z","dateModified":"2026-10-04T13:04:52.204Z","description":"Disabling the sign-up flow in Entra External ID user flows prevents bots from abusing SMS or phone verification to rack up tenant costs. A PowerShell script...","image":"https://i0.wp.com/damienbod.com/wp-content/uploads/2026/03/disablesign-up-entraexternalid_01.png?fit=1200%2C826&ssl=1","thumbnailUrl":"https://i0.wp.com/damienbod.com/wp-content/uploads/2026/03/disablesign-up-entraexternalid_01.png?fit=1200%2C826&ssl=1","isAccessibleForFree":true,"articleSection":"Damien Bowden","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Damien Bowden","logo":"https://media.daily.dev/image/upload/s--MpH73n5h--/f_auto,q_auto/v1791119042/logos/damienbod?_a=BAMAMicg0","url":"https://daily.dev/sources/damienbod"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/remove-sign-up-from-entra-external-id-user-flows-6yv1ippcd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cloud,microsoft,authentication,powershell","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Damien Bowden","item":"https://daily.dev/sources/damienbod"},{"@type":"ListItem","position":3,"name":"Remove sign-up from Entra External ID user flows"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/remove-sign-up-from-entra-external-id-user-flows-6yv1ippcd#faq","mainEntity":[{"@type":"Question","name":"How do I disable the sign-up flow in Entra External ID to stop SMS verification cost abuse?","acceptedAnswer":{"@type":"Answer","text":"Use a PowerShell script with the Microsoft Graph Identity.SignIns module to update the self-service sign-up event flow and set isSignUpAllowed to false. The script requires an Azure App registration with the EventListener.ReadWrite.All Graph permission, plus the tenant ID, application client ID, and client secret, and queries Get-MgIdentityAuthenticationEventFlow to find the user flow before updating it. Developers hardening Entra External ID against SMS-fraud bots can find similar identity configuration guidance on daily.dev."}},{"@type":"Question","name":"Why would bots exploit SMS or phone verification in an identity sign-up flow?","acceptedAnswer":{"@type":"Answer","text":"Bots can create accounts and trigger phone or SMS validation during unauthenticated sign-up flows purely to run up telecom charges billed to the tenant, since each verification attempt costs money regardless of whether an account is ever legitimately used. This is why SMS or phone verification should not be exposed in unauthenticated sign-up flows, and IAM systems should instead support passkeys or authenticator apps for MFA. Teams designing sign-up and MFA flows can track identity security practices like this on daily.dev."}}]} ```