# (L2) Ensure the email OTP authentication method is disabled

The email one-time passcode (Email OTP) authentication method is disabled in the Microsoft Entra authentication methods policy.

Source: https://maester.dev/docs/tests/CIS.M365.5.2.3.7

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Entra ID · Authentication methods · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.5.2.3.7
```

## Overview

The email one-time passcode (Email OTP) authentication method is disabled in the Microsoft Entra authentication methods policy.

Email OTP sends a passcode to an email address, and Microsoft Entra uses it to sign in B2B guest users who cannot authenticate with another method. Whoever controls or intercepts that inbox can sign in as the guest, and the inbox of an external user is outside your control. A phished or compromised mailbox then gives access to the resources the guest can reach.

Disabling the method means unverified guests can no longer redeem invitations with an emailed passcode. They must use a Microsoft account, a Microsoft Entra account, a federated identity provider or a social identity provider, or be configured as a guest in your tenant.

#### Remediation action

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
2. Go to **Entra ID** > **Authentication methods** > [**Policies**](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods).
3. Select **Email OTP**.
4. Set **Enable** to off.
5. Select **Save**.

To disable the method with PowerShell, connect with `Connect-MgGraph -Scopes 'Policy.ReadWrite.AuthenticationMethod'` and run:

```powershell
$params = @{
    '@odata.type' = '#microsoft.graph.emailAuthenticationMethodConfiguration'
    state = 'disabled'
}
Update-MgPolicyAuthenticationMethodPolicyAuthenticationMethodConfiguration -AuthenticationMethodConfigurationId 'Email' -BodyParameter $params
```

#### Related links

* [Microsoft Entra admin center - Authentication methods policies](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods)
* [How to migrate to the Authentication methods policy](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods-manage)
* [Email one-time passcode authentication for B2B guest users](https://learn.microsoft.com/entra/external-id/one-time-passcode)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.7](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.5.2.3.7 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Authentication methods |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1111 Multi-Factor Authentication Interception |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.7 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2 |
| Supports controls | cis-m365:5.2.3.7, nist-800-53-r5:CM-7, nist-800-53-r5:IA-5 |
| PowerShell test | [Test-MtCisEmailOtpAuthenticationMethodDisabled](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.3.7.ps1) |
| Services | Graph |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.5.2.3.7.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.3.7.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.5.2.3.7.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.3.7.md)