Require people who use a verification code to reauthenticate regularly

Description

External recipients who authenticate with a one-time verification code sent by email and choose to stay signed in must prove again that they control the mailbox every {{ verification_code_reauth_days }} days (EmailAttestationRequired = True, EmailAttestationReAuthDays).

This SharePoint setting applies to recipients authenticated by SharePoint itself. When Microsoft Entra B2B integration is on (CB-M365-COLLAB-002), guests use the Entra B2B email one-time passcode instead and the Entra session controls apply.

Rationale

A verification code proves control of a mailbox once. Without reauthentication, a session cookie opened on a shared or lost computer, or a mailbox that the person no longer controls (left the company, recycled address), keeps access to the shared files for as long as the cookie lives. A short reauthentication period bounds that window.

Impact

External recipients using verification codes receive a new code by email every {{ verification_code_reauth_days }} days. Microsoft retires SharePoint one-time passcode authentication for commercial tenants in October 2026; after that, the setting only matters for tenants where it still applies, and the reauthentication of B2B guests depends on Entra Conditional Access session controls.

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a Global Reader.
2. Browse to Policies > Sharing > More external sharing settings and check that People who use a verification code must reauthenticate after this many days is selected with at most {{ verification_code_reauth_days }}.
3. With the SharePoint Online Management Shell (SharePoint Administrator): Get-SPOTenant | Select-Object EmailAttestationRequired, EmailAttestationReAuthDays.
4. Fail if external sharing is allowed and EmailAttestationRequired is False or EmailAttestationReAuthDays is greater than {{ verification_code_reauth_days }}.

Remediation

1. In the SharePoint admin center, browse to Policies > Sharing > More external sharing settings, select People who use a verification code must reauthenticate after this many days, enter {{ verification_code_reauth_days }} and Save. Role: SharePoint Administrator.
2. PowerShell equivalent: Set-SPOTenant -EmailAttestationRequired $true -EmailAttestationReAuthDays {{ verification_code_reauth_days }}.
3. For B2B guests, bound the session with a Conditional Access policy targeting Guest or external users with Sign-in frequency set to the same number of days.

References

• Manage sharing settings for SharePoint and OneDrive in Microsoft 365 Microsoft, vendor-doc, accessed 2026-10-24
• Secure external sharing recipient experience Microsoft, vendor-doc, accessed 2026-10-24
• Set-SPOTenant (SharePoint Online Management Shell) Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft SharePoint Online and OneDrive baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-COLLAB-002 Enable SharePoint and OneDrive integration with Microsoft Entra B2B
• related CB-M365-AUTH-012 Disable email one-time passcodes

People and lifecycle