How to Configure One-Time Passcodes for SharePoint Guests
Question details
The user needs to set up and enforce one-time passcode (OTP) authentication for external guests accessing shared SharePoint files.
- Product
- Microsoft SharePoint
- Device & OS
- not provided
- Scenario
- Sharing internal SharePoint files or folders securely with external guest users who do not have a registered Microsoft account.
- Observed behavior
- External guests should receive a one-time passcode via email to authenticate their identity before accessing the shared resources, providing a secure alternative to regular passwords.
Ensure you have Global Administrator or Security Administrator privileges in your Microsoft 365 tenant to access and modify Microsoft Entra ID and external sharing settings.
Enable Email One-Time Passcodes in Microsoft Entra ID
This enables the foundational OTP feature for B2B collaboration, allowing guests to authenticate via email codes instead of creating Microsoft accounts.
By default, if external guests do not have a Microsoft account or a managed Azure AD account, they can use an email one-time passcode. You must ensure this feature is explicitly enabled in your external identity provider settings to guarantee seamless guest access.
Log in to the Microsoft Entra admin center using an account with the appropriate administrator permissions.
In the left-hand navigation pane, expand 'External identities' and then click on 'All identity providers'.
From the list of configured providers, select the 'Email one-time passcode' option.
Check the box or toggle the option to 'Enable email one-time passcode for guests' and click 'Save' to apply your changes.
Configure SharePoint External Sharing Settings
Adjust your SharePoint admin center settings to enforce secure access and session timeouts for external guests.
Enhance Document Collaboration with WPS Office
While SharePoint and Microsoft Entra ID manage secure file sharing and guest authentication, WPS Office provides a free, lightweight, and highly compatible productivity suite for creating and editing your team's documents. It natively supports Microsoft Office files, ensuring external guests and internal teams can collaborate without formatting issues.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install the Software: Run the downloaded installer and follow the quick on-screen prompts to set up the suite on your computer.
- 3. Open Shared Documents: Launch WPS Office and directly open any Word, Excel, or PowerPoint files downloaded from your shared SharePoint folders.
Frequently Asked Questions
Why wasn't the SharePoint guest prompted for a passcode the second time they accessed the file?
Once a guest authenticates with a one-time passcode, their active session is cached in their web browser. They will not be prompted to enter a new passcode until that session naturally expires, based on your organization's timeout settings, or if they clear their browser cookies.
Can I force SharePoint guests using OTP to change their passwords regularly?
No. One-time passcodes are generated dynamically and sent via email for single-use authentication. Because they are not standard user-created passwords, traditional password-change and expiration policies cannot be applied.
Where is the one-time passcode sent when sharing a SharePoint file?
The passcode is sent directly to the exact email address that the internal user entered when initially sending the sharing invitation to the external guest.
What should the guest do if the OTP email is delayed or lost?
The guest can request a new passcode directly from the SharePoint sign-in prompt. They should also verify that the email address was typed correctly and check their spam or junk folders, as automated authentication emails are occasionally filtered out by email providers.
