Authentication Method Policy - Email OTP
Send a one-time code to a user’s email for authentication. For internal (member) accounts, it is usable only for self-service password recovery. For external (guest) users without a managed identity, Email OTP can serve as a valid sign-in method.
Settings this baseline controls
| Setting | What it does |
|---|---|
| Method enabled | Specifies whether Email OTP authentication method is enabled or disabled for the tenant. Learn more |
Configure it
This baseline turns email one-time passcodes off tenant-wide. Add it to the tenant, or to every tenant through a scheme, wherever you want to close off a weak sign-in method rather than leave it available to guests.
-
Add the baseline to the tenant directly (Adding a baseline) or through a scheme (Deploying a scheme).
-
Turn Method enabled off. Email OTP is easy to phish (the code goes to an inbox an attacker may already control), so the baseline recommends against leaving it available for either guest sign-in or self-service password recovery.
-
Save. Turn on Auto-remediation if you want Octiga to switch it back off whenever someone re-enables it in Microsoft Entra.
Check it worked
Passing means Entra ID → Authentication methods → Policies → Email OTP shows the method disabled. Internal users notice nothing day to day; a guest who previously signed in with an emailed code is asked for a different method the next time they sign in.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.