How are you dealing with bot registrations in Entra B2C?

If registration doesn't need to be completely open, try invite codes or a trigger-based registration flow. That changes the problem from filtering every public signup attempt to controlling who can start the process.

It won't fit every product, though. If anyone needs to be able to join immediately, an invite gate may be too much friction.

Are you using custom policies? B2C custom policies can give you more control over the registration flow and let you implement additional protective mechanisms. The useful part is being able to decide where checks happen before an account is provisioned.

That's still something you'd need to design and maintain. Custom policies aren't a bot filter by themselves.

Behavior-based bot detection is another option to evaluate. Stylobot is one example mentioned for use in or alongside an application, with detection that adapts to user behavior.

I'd test it against your own traffic before relying on it. Check whether it catches the scripts you're seeing and what happens to legitimate registrations.

Keep the product roadmap in view too. Entra B2C is being phased out, and Entra External ID is the recommended direction. That doesn't mean a migration will automatically solve the bot problem, so evaluate registration protection separately from the move.

I wouldn't jump straight to hardware-based human verification. It might add a substantial barrier for real users, and there's not enough here to say it would stop the traffic you're seeing.

First figure out which part of the registration flow the requests are reaching and what costs they're generating. That should help you judge whether a proposed check happens early enough to make a difference.