'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Add CAPTCHA Before Microsoft Entra ID SAML MFA
Question details
A developer or IT admin needs to require users to pass a CAPTCHA challenge before being redirected to Microsoft Entra ID for SAML-based Multi-Factor Authentication (MFA).
- Product
- Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Securing a cloud-only SAML application's sign-in flow by adding CAPTCHA validation prior to the Entra ID SSO redirection.
- Observed behavior
- Users currently bypass CAPTCHA because Entra ID's hosted sign-in page does not natively support arbitrary CAPTCHA integration.
Ensure you have administrative access to your application's source code and configuration, as well as an active developer account with a CAPTCHA provider such as Google reCAPTCHA or hCaptcha.
Implement CAPTCHA Validation at the Application Level
Integrate a third-party CAPTCHA service directly into your custom application's sign-in page before initiating the SSO request.
Microsoft Entra ID does not provide a native feature to insert a custom CAPTCHA into its hosted authentication pages. To solve this in a cloud-only environment, you must handle the CAPTCHA validation on your application's side before redirecting the user to Entra ID for SAML MFA.
Register your application with a service like Google reCAPTCHA or hCaptcha and obtain the necessary public and private API keys.
Embed the CAPTCHA widget into your application's local login frontend alongside the standard username and password fields.
Configure your application backend to intercept the login submission and validate the generated CAPTCHA token using your provider's verification API.
Only after your backend successfully validates the CAPTCHA token, trigger the SAML authentication request and redirect the user to Microsoft Entra ID for MFA.
Enhance Your Business Productivity with WPS Office
While you secure your enterprise identity infrastructure with Entra ID, optimize your team's document workflows with WPS Office. It provides a lightweight, highly compatible, and cost-effective alternative to Microsoft Office.
- 1. Download the Installer: Visit the official WPS website to download the free installation package for your operating system.
- 2. Install WPS Office: Run the setup file and follow the straightforward on-screen instructions to deploy the software.
- 3. Open Existing Documents: Launch WPS Office and directly open your existing .docx, .xlsx, and .pptx files with full formatting retention.
Frequently Asked Questions
Can I add Google reCAPTCHA directly to the Microsoft Entra ID login screen?
No, Microsoft Entra ID does not support embedding custom third-party CAPTCHA widgets directly into its hosted sign-in pages. All validation must happen prior to redirection.
Do I need an AD FS environment to implement CAPTCHA for SAML apps?
No. For cloud-only environments without Active Directory Federation Services (AD FS), you simply implement the CAPTCHA challenge within your application's custom frontend before sending the SAML SSO request.
What happens if a user fails the CAPTCHA challenge?
Your application must be configured to block the authentication flow immediately upon a failed CAPTCHA. The user should not be redirected to Microsoft Entra ID, preventing unauthorized access attempts or spam.
Does Microsoft Entra ID have built-in bot protection?
Yes, Microsoft Entra ID includes built-in risk-based authentication and Identity Protection features that detect anomalous sign-in attempts. These native tools often serve as a robust alternative to traditional visual CAPTCHAs.
