(L2) Ensure the email OTP authentication method is disabled

Contributed by jeremy finneyAll contributors →

Part of CIS · Entra ID · Authentication methods · All checks

Run this check

Invoke-Maester -TestId CIS.M365.5.2.3.7

Overview

The email one-time passcode (Email OTP) authentication method is disabled in the Microsoft Entra authentication methods policy.

Email OTP sends a passcode to an email address, and Microsoft Entra uses it to sign in B2B guest users who cannot authenticate with another method. Whoever controls or intercepts that inbox can sign in as the guest, and the inbox of an external user is outside your control. A phished or compromised mailbox then gives access to the resources the guest can reach.

Disabling the method means unverified guests can no longer redeem invitations with an emailed passcode. They must use a Microsoft account, a Microsoft Entra account, a federated identity provider or a social identity provider, or be configured as a guest in your tenant.

Remediation action

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID > Authentication methods > Policies.
3. Select Email OTP.
4. Set Enable to off.
5. Select Save.

To disable the method with PowerShell, connect with Connect-MgGraph -Scopes 'Policy.ReadWrite.AuthenticationMethod' and run:

$params = @{
    '@odata.type' = '#microsoft.graph.emailAuthenticationMethodConfiguration'
    state = 'disabled'
}
Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId 'Email' -BodyParameter $params

Related links

• Microsoft Entra admin center - Authentication methods policies
• How to migrate to the Authentication methods policy
• Email one-time passcode authentication for B2B guest users
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.7

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.5.2.3.7
Severity	Medium
Suite	CIS
Product	Entra ID
Feature	Authentication methods
Area	Authentication
Resource type	Tenant
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	T1078.004 Cloud Accounts, T1111 Multi-Factor Authentication Interception
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.7
Benchmark level	L2
Benchmark profiles	E3 Level 2
Supports controls	cis-m365:5.2.3.7, nist-800-53-r5:CM-7, nist-800-53-r5:IA-5
PowerShell test	Test-MtCisEmailOtpAuthenticationMethodDisabled
Services	Graph

Source

• Test: tests/cis/Test.CIS.M365.5.2.3.7.ps1
• Documentation: tests/cis/Test.CIS.M365.5.2.3.7.md