I’m using Azure custom policies in our React single page application.

For the Reset Password flow, I’m using the standard PasswordReset user journey provided with the local account starter pack.

This journey references to in the TrustFrameworkBase policy.

At the moment, if a user is not registered in the web app, the password reset journey still sends an OTP to the email.

The email receives the OTP, even if not registered, and can insert the code.

Once the code is validated, clicking on the “Continue” button does nothing. The user is stuck on the page without any information.

Checking the console I found out that the SelfAsserted call returns the error “404 user not found”.

I would like to stop the user before sending the OTP and inform him with an error message (that the account is not registered and to proceed with the registration).

I tried to add:

<Item Key="RaiseErrorIfClaimsPrincipalDoesNotExist">true</Item>
in the TechnicalProfile of the first OrchestrationStep, but it does nothing.

I would expect the policy to show an error and not send the otp code to the user.

Any suggestion on how to stop a non existing user from proceeding to the Reset Password journey?