{
  "id": "CB-M365-AUTH-012",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-012",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-012.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-012.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-012",
    "title": "Disable email one-time passcodes",
    "finding": {
      "title": "Email one-time passcodes are allowed",
      "description": "Guests can redeem invitations and sign in with a code sent to their mailbox, and members can reset their password with one, so control of a mailbox is enough to authenticate."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "email-otp",
      "guests",
      "b2b",
      "authentication-methods"
    ],
    "description": "The **Email OTP** method is disabled in the Authentication methods policy, including its\n**Allow external users to use email OTP** option, and **Email one-time passcode for guests** is\nset to **No** under External Identities. Guests then authenticate with their own Entra ID\naccount, a Microsoft account or a configured identity provider; members reset their password\nwith stronger methods.\n",
    "rationale": "An email code proves only access to a mailbox, often a personal or poorly protected one outside\nany MFA policy. It is a common entry point for guest account takeover and for password reset\nabuse.\n",
    "impact": "Guests without an Entra ID or Microsoft account can no longer redeem invitations; they are asked\nto create a Microsoft account. Guests who already redeemed with a code cannot sign in until\ntheir redemption status is reset. Members lose email as a password reset method. List existing\nguests that use email OTP before the change.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Authentication methods** > **Policies** > **Email OTP**: check\n   that **Enable** is off and, on **Configure**, that **Allow external users to use email\n   OTP** is **No**.\n3. Browse to **Entra ID** > **External Identities** > **All identity providers**, **Built-in**\n   tab, **Email one-time passcode**: check **Email one-time passcode for guests** is **No**.\n4. Read-only alternative with Microsoft Graph PowerShell (scope `Policy.Read.All`):\n   `Get-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId Email | Select-Object State, @{n='External';e={$_.AdditionalProperties.allowExternalIdToUseEmailOtp}}`\n5. Fail if the method is enabled, or if `allowExternalIdToUseEmailOtp` is `enabled` or\n   `default`.\n"
    },
    "remediation": {
      "manual": "1. List guests whose sign-ins use email OTP and agree an alternative with their sponsors.\n2. Sign in to the Microsoft Entra admin center as at least an Authentication Policy\n   Administrator.\n3. Browse to **Entra ID** > **Authentication methods** > **Policies** > **Email OTP**. On\n   **Configure**, set **Allow external users to use email OTP** to **No**; on **Enable and\n   target**, turn **Enable** off. Save.\n4. Browse to **Entra ID** > **External Identities** > **All identity providers** > **Email\n   one-time passcode** and set **Email one-time passcode for guests** to **No**. Save.\nGraph equivalent: `PATCH /policies/authenticationMethodsPolicy/authenticationMethodConfigurations/Email`\nwith `{\"@odata.type\": \"#microsoft.graph.emailAuthenticationMethodConfiguration\", \"state\": \"disabled\", \"allowExternalIdToUseEmailOtp\": \"disabled\"}`.\n",
      "rollback": "Set **Email one-time passcode for guests** back to **Yes** and re-enable the method. Reset the\nredemption status of guests who were locked out.\n"
    },
    "references": [
      {
        "title": "Email one-time passcode authentication for B2B guest users",
        "url": "https://learn.microsoft.com/entra/external-id/one-time-passcode",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "How to migrate MFA and SSPR policy settings to the Authentication methods policy",
        "url": "https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-methods-manage",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Entra ID baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.AAD.3.5v2",
        "relation": "partial",
        "note": "Covers the email OTP part only (SMS and voice are CB-M365-AUTH-011); hardened profile here, a SHALL in SCuBA."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-5",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-8",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-011",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-012",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}