Disable email one-time passcodes

Description

The Email OTP method is disabled in the Authentication methods policy, including its Allow external users to use email OTP option, and Email one-time passcode for guests is set to No under External Identities. Guests then authenticate with their own Entra ID account, a Microsoft account or a configured identity provider; members reset their password with stronger methods.

Rationale

An email code proves only access to a mailbox, often a personal or poorly protected one outside any MFA policy. It is a common entry point for guest account takeover and for password reset abuse.

Impact

Guests without an Entra ID or Microsoft account can no longer redeem invitations; they are asked to create a Microsoft account. Guests who already redeemed with a code cannot sign in until their redemption status is reset. Members lose email as a password reset method. List existing guests that use email OTP before the change.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Authentication methods > Policies > Email OTP: check that Enable is off and, on Configure, that Allow external users to use email OTP is No.
3. Browse to Entra ID > External Identities > All identity providers, Built-in tab, Email one-time passcode: check Email one-time passcode for guests is No.
4. Read-only alternative with Microsoft Graph PowerShell (scope Policy.Read.All): Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId Email | Select-Object State, @{n='External';e={$_.AdditionalProperties.allowExternalIdToUseEmailOtp}}
5. Fail if the method is enabled, or if allowExternalIdToUseEmailOtp is enabled or default.

Remediation

1. List guests whose sign-ins use email OTP and agree an alternative with their sponsors.
2. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
3. Browse to Entra ID > Authentication methods > Policies > Email OTP. On Configure, set Allow external users to use email OTP to No; on Enable and target, turn Enable off. Save.
4. Browse to Entra ID > External Identities > All identity providers > Email one-time passcode and set Email one-time passcode for guests to No. Save. Graph equivalent: PATCH /policies/authenticationMethodsPolicy/authenticationMethodConfigurations/Email with {"@odata.type": "#microsoft.graph.emailAuthenticationMethodConfiguration", "state": "disabled", "allowExternalIdToUseEmailOtp": "disabled"}.

Rollback

Set Email one-time passcode for guests back to Yes and re-enable the method. Reset the redemption status of guests who were locked out.

References

• Email one-time passcode authentication for B2B guest users Microsoft, vendor-doc, accessed 2026-10-24
• How to migrate MFA and SSPR policy settings to the Authentication methods policy Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Entra ID baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-011 Disable SMS and voice call as authentication methods
• related CB-M365-COLLAB-012 Require people who use a verification code to reauthenticate regularly

People and lifecycle