title: Azure AD B2C Password reset policy with alternate email address
body: <p>I created a password reset policy and I am using username for the identity provider for local account.</p>
  
  <p>The password reset screen asking for username and email address. 
  What if I know someone's username but to use a different email to receive the verification code then I will be able to access someone else's account. </p>
  
  <p>I saw it used to have a check box for password reset to use "Alternate Email Address" which is much secure to allow the user input a one.  But I can't find to use "Alternate Email address" in password reset policy. </p>
  
  <p>Does anyone know where to set it?
  <a href="https://i.stack.imgur.com/vRF1W.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/vRF1W.png" alt="enter image description here"></a>
  <a href="https://i.stack.imgur.com/jjnAX.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/jjnAX.png" alt="enter image description here"></a></p>