Fix Guest Access OTP Available Despite MFA Policy in Microsoft 365
Question details
The administrator wants to prevent guest users from signing in via one-time passcode (OTP) and force them to use multifactor authentication (MFA) or a Microsoft account.
- Product
- Microsoft 365 / Entra ID
- Device & OS
- not provided
- Scenario
- An admin has disabled OTP authentication and created a Conditional Access policy requiring MFA for external identities, but the configuration does not seem to take effect.
- Observed behavior
- The OTP sign-in option remains visible and accessible to guest users even after disabling it and implementing an MFA Conditional Access policy.
Ensure you have Conditional Access Administrator or Global Administrator privileges in your Microsoft Entra ID tenant to view and modify external identity settings and policies.
Verify External Identities and Conditional Access Settings
Check Microsoft Entra ID configurations to ensure OTP is completely disabled and the Conditional Access policy is properly targeting guest accounts without conflicts.
Often, policies may not apply as expected due to caching, conflicting policy exclusions, or incorrect assignment targeting in Microsoft Entra ID. Verifying every layer of external access settings helps isolate the fault.
Navigate to the Microsoft Entra admin center, go to External Identities > External collaboration settings, and verify that the Email OTP feature is fully disabled.
Open your Conditional Access policies and confirm that the target policy explicitly includes 'Guest or external users' in the Users assignment section.
Review the 'Grant' section of the policy to ensure 'Require multifactor authentication' is selected, and check if any restrictive authentication strengths are appropriately configured.
Check the Exclusions tab for users, groups, or locations. Ensure the affected guest accounts or their domains are not accidentally bypassing the policy.
Revoke existing sessions for the test guest user in Entra ID. Send a new guest invitation and test the login process using an InPrivate or Incognito browser window to prevent cached credential issues.
Escalate to Microsoft 365 Support
If all configurations are correct but the OTP option still persists, a backend tenant issue may require Microsoft Support's intervention.
Enhance Your Productivity with WPS Office
While you are busy managing complex tenant administration and conditional access policies in Microsoft 365, you need a hassle-free, lightweight solution for your local document workflows. WPS Office is a powerful, free alternative that ensures your daily tasks remain uninterrupted.
- 1. Download the Installer: Visit the official WPS Office website and download the free installer for your operating system.
- 2. Install WPS Office: Run the setup file and follow the quick installation prompts to set up the suite on your device.
- 3. Open and Edit Microsoft Documents: Launch WPS Office and directly open any Word, Excel, or PowerPoint files to experience seamless formatting compatibility.
Frequently Asked Questions
Why does the OTP sign-in option still show up for guest users?
This can happen due to cached browser sessions, active session tokens that haven't expired, conflicting exclusions in your Conditional Access policies, or propagation delays in Microsoft Entra ID.
How do I force guest users to use MFA instead of OTP?
You need to explicitly disable the Email One-Time Passcode feature in the External Identities settings of Entra ID and assign a Conditional Access policy targeting 'Guest or external users' that grants access only when multifactor authentication is satisfied.
Can I test my Conditional Access policy without disrupting other users?
Yes. You can set your Conditional Access policy to 'Report-only' mode. This allows you to review the Entra ID sign-in logs to see if the policy would have successfully blocked OTP and enforced MFA for specific guest accounts before enforcing it tenant-wide.
How long does it take for Conditional Access policy changes to apply?
While changes often take effect within a few minutes, Microsoft states that policy updates and external identity configurations can sometimes take up to 24 hours to fully replicate and enforce across all cloud services.
