MFA Security Issues

Fix Save Button Disabled When Disabling Email OTP in Microsoft Entra

Guest Writer Oct 7, 2026 869 views

Question details

Administrator cannot save changes when attempting to disable email one-time passwords in Microsoft Entra.

How to Fix Save Button Disabled When Disabling Email OTP in Microsoft Entra

Product: Microsoft Entra Admin Center
Device & OS: not provided
Scenario: Turning off the email OTP authentication method for users in the tenant.
Observed behavior: The Save button remains disabled (greyed out) when trying to turn off the email OTP method, preventing the administrator from applying the configuration change.

Before you start

Ensure you are signed into the Microsoft Entra admin center with an account that has Global Administrator or Authentication Policy Administrator privileges.

Solution 1Recommended

Toggle Target Settings to Force UI Activation

This workaround forces the Microsoft Entra admin center to activate the Save button by temporarily enabling the feature for all users.

Due to a known interface behavior in the admin center, the form may not validate your request to disable the feature if a target audience wasn't properly registered in the current state.

Enable Email OTP temporarily

In the authentication methods policy, switch the Email OTP setting to 'Enable' and explicitly set the target to 'All users'.

Save the initial change

Click the Save button at the bottom of the page, which should now be active, to register this configuration.

Disable the feature

Once the previous change is saved successfully, toggle the Email OTP setting back to 'Disable' and select the acknowledgment checkbox if prompted.

Save the final configuration

Click the Save button again. The system will now successfully process your request to turn off email one-time passwords for your tenant.

Toggle Target Settings to Force UI Activation

Configuration Tip: Setting the default target to 'All users' initially helps bypass this UI validation hurdle and reduces confusion for new administrators managing MFA settings.

Solution 2

Disable Email OTP via Microsoft Graph API

If the admin center GUI remains unresponsive, use the Microsoft Graph API or PowerShell scripts to programmatically update the authentication policy.

Solution 3

Escalate to Microsoft Support

If the Save button remains disabled despite workarounds and API scripts fail, escalate the issue as a potential tenant-level bug.

Free Microsoft Office alternative

Manage IT Documentation Seamlessly with WPS Office

Writing PowerShell scripts, documenting Entra ID configurations, and creating IT manuals requires a reliable office suite. WPS Office provides a lightweight, free alternative to Microsoft Office, offering full format compatibility, a familiar UI, and a seamless migration experience without the heavy subscription costs.

1. Download the installer: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install the software: Run the installer and follow the simple on-screen instructions to set up WPS Office on your workstation.
3. Open and edit documentation: Launch WPS Office to instantly open, edit, and save your existing Microsoft Office IT documentation.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).Ideal for creating and sharing IT administrative guides, API script templates, and security policies.Lightweight installation that runs smoothly on any admin workstation without consuming excessive system resources.Free to use with a familiar tabbed interface, ensuring zero learning curve for seamless migration.

microsoft office alternative - wps office

Frequently Asked Questions

Why is the Save button disabled when modifying email OTP in Entra?

This is often caused by a form validation requirement in the admin center UI. The system may require the method's target to be explicitly set (such as to 'All users') and saved first before it recognizes the 'disable' toggle as a valid configuration change.

What permissions are required to disable Email OTP?

You need to be assigned either the Global Administrator role or the Authentication Policy Administrator role in Microsoft Entra to modify authentication method policies.

Can I automate the process of disabling Email OTP?

Yes, you can use the Microsoft Graph API or Microsoft Graph PowerShell SDK to programmatically read and update the email authentication method configurations across your tenant.

Microsoft Office Security Issues