# Authentication Method Policy - Email OTP

> Send a one-time code to a user’s email for authentication.

Send a one-time code to a user’s email for authentication. For internal (member) accounts, it is usable only for self-service password recovery. For external (guest) users without a managed identity, Email OTP can serve as a valid sign-in method.

## Settings this baseline controls

| Setting        | What it does                                                                                                                                                                                        |
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Method enabled | Specifies whether Email OTP authentication method is enabled or disabled for the tenant. [Learn more](https://learn.microsoft.com/en-us/graph/api/resources/emailauthenticationmethodconfiguration) |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline turns email one-time passcodes off tenant-wide. Add it to the tenant, or to every tenant through a scheme, wherever you want to close off a weak sign-in method rather than leave it available to guests.

1. Add the baseline to the tenant directly ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)) or through a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. Turn **Method enabled** off. Email OTP is easy to phish (the code goes to an inbox an attacker may already control), so the baseline recommends against leaving it available for either guest sign-in or self-service password recovery.
3. Save. Turn on **Auto-remediation** if you want Octiga to switch it back off whenever someone re-enables it in Microsoft Entra.

> **Caution:** Turning this off removes email one-time codes as a self-service password recovery option for internal users, and as a sign-in method for any guest who has no other way in. Before you disable it, check that your organisation has another recovery method registered, such as [Authentication Method Policy - Microsoft Authenticator](https://docs.octiga.io/baselines/access-management/authentication-methods-microsoft-authenticator/), and that guests who rely on Email OTP have a working alternative.

## Check it worked

Passing means **Entra ID → Authentication methods → Policies → Email OTP** shows the method disabled. Internal users notice nothing day to day; a guest who previously signed in with an emailed code is asked for a different method the next time they sign in.

## Standards this addresses

### CIS

- **M365 5.2.3.x** — CIS M365 Foundations Benchmark 5.2.3.x
- **v8 6.3** — CIS Controls v8 Safeguard 6.3

### NIST

- **PR.AC-7** — NIST CSF 2.0 PR.AC-7
- **IA-5** — NIST SP 800-53 IA-5

### ISO 27001

- **A.8.3.3** — ISO/IEC 27001:2022 Annex A.8.3.3

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)