CIS.M365.5.2.3.7 - (L2) Ensure the email OTP authentication method is disabled
Overview
The email one-time passcode (Email OTP) authentication method is disabled in the Microsoft Entra authentication methods policy.
Email OTP sends a passcode to an email address, and Microsoft Entra uses it to sign in B2B guest users who cannot authenticate with another method. Whoever controls or intercepts that inbox can sign in as the guest, and the inbox of an external user is outside your control. A phished or compromised mailbox then gives access to the resources the guest can reach.
Disabling the method means unverified guests can no longer redeem invitations with an emailed passcode. They must use a Microsoft account, a Microsoft Entra account, a federated identity provider or a social identity provider, or be configured as a guest in your tenant.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Authentication methods > Policies.
- Select Email OTP.
- Set Enable to off.
- Select Save.
To disable the method with PowerShell, connect with Connect-MgGraph -Scopes 'Policy.ReadWrite.AuthenticationMethod' and run:
$params = @{
'@odata.type' = '#microsoft.graph.emailAuthenticationMethodConfiguration'
state = 'disabled'
}
Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId 'Email' -BodyParameter $params
Related links
- Microsoft Entra admin center - Authentication methods policies
- How to migrate to the Authentication methods policy
- Email one-time passcode authentication for B2B guest users
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.7
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.3.7 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Authentication methods |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1111 Multi-Factor Authentication Interception |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.7 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2 |
| Supports controls | cis-m365:5.2.3.7, nist-800-53-r5:CM-7, nist-800-53-r5:IA-5 |
| PowerShell test | Test-MtCisEmailOtpAuthenticationMethodDisabled |
| Services | Graph |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.3.7.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.3.7.md