Azure AD B2C custom flow validates password but does not accept

Using the Azure B2C custom policy starter pack. Updated TrustedFrameworkBase.xml with new password regex. Password fields at sign-up validate the value in accordance with the configured regex but on submit, the password is rejected due to "complexity requirements". Are there complexity requirements set somewhere other than the custom policy XML?

When it comes to azure ad password complexity, we have three complexity options available

Simple: Password That is at least 8 to 64 characters.

Strong: 8 to 64 characters and it requires 3 out of 4 lowercase, uppercase, numbers or symbols.

Custom: It allows you configure custom length, and it also allows accepts Number only passwords

As You are using custom policy starter pack and as you are aware TrustFrameworkBase.xml is a file where the Predicates are found. With Predicates and PredicateValidationsInput you can control the complexity requirements for passwords provided by a user when creating an account.

So the first step you need to do is disabling B2C’s password restrictions by adding ‘DisableStrongPassword’ to the password policy claim.

<PersistedClaim ClaimTypeReferenceId="passwordPolicies" DefaultValue="DisablePasswordExpiration, DisableStrongPassword"/>

And then attach a regex(regual expression) to the Password field with your requirements.(like length of the password..)

ReferenceConfigure password complexity requirements - Azure AD B2C | Microsoft Docss