Why Guest Invitations Work After Disabling AllowEmailVerifiedUsers in Microsoft Entra ID
Question details
Understand why guest users can still redeem B2B invitations using email passcodes after disabling the AllowEmailVerifiedUsers setting.
- Product
- Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Managing external identities and securing B2B guest user authentication flows.
- Observed behavior
- Invited guest users successfully accept invitations and authenticate using email one-time passcodes (OTP) even though AllowEmailVerifiedUsers is set to false.
Ensure you have External Identity Provider administrator access in the Microsoft Entra admin center to view and modify collaboration settings.
Disable Email One-Time Passcode for Guests
Turn off the email OTP fallback feature to enforce stricter identity provider requirements for B2B guest invitations.
The AllowEmailVerifiedUsers setting controls self-service sign-up for email-verified users, which is entirely separate from B2B collaboration authentication. When a guest lacks a Microsoft account or a federated identity provider, the system falls back to Email One-Time Passcode (OTP) if it is enabled. To completely block this authentication path, you must explicitly disable the email OTP feature.
Sign in to the Microsoft Entra admin center, navigate to 'Identity', expand 'External Identities', and click on 'All identity providers'.
Locate and select 'Email one-time passcode' from the list of configured identity providers.
Under the 'Email one-time passcode for guests' section, select the 'Disable email one-time passcode for guests' option.
Click 'Save' at the top of the pane to apply the changes across your tenant.
Streamline Your Team's Workflow with WPS Office
While navigating complex Microsoft Entra ID security policies and external identity configurations, you might seek a more straightforward, reliable productivity suite for your organization. WPS Office provides a powerful, lightweight alternative to Microsoft Office, minimizing IT overhead while maximizing user productivity.
- 1. Download the Installer: Visit the official WPS Office website and click the Free Download button.
- 2. Install the Suite: Run the setup file and follow the simplified installation wizard to complete the process in minutes.
- 3. Start Creating: Open WPS Office to instantly view, edit, and securely share your documents.
Frequently Asked Questions
What is the difference between AllowEmailVerifiedUsers and Email OTP?
AllowEmailVerifiedUsers dictates whether external users can independently perform self-service sign-up by verifying their email. Email OTP, conversely, is an authentication method allowing invited B2B guests to sign in using a temporary code sent to their email when they lack a supported identity provider.
Will disabling Email OTP lock out all my B2B guests?
No. Guests who authenticate using an established Microsoft account, a federated identity provider like Google, or SAML/WS-Fed will continue to sign in normally. It only affects those relying on passcode emails.
How can I securely invite external users without Email OTP?
You can require external users to create a free Microsoft account tied to their work email, or you can configure direct federation with their organization's identity provider (such as Google or SAML) for seamless and secure access.
