How can you stop using B2B signup flow with one-time email passcodes and force user/pass

Question

1. Email One-Time Passcode (OTP) Cannot Be Disabled:

Azure AD is enforcing email OTP authentication for our external identity users with no apparent way to disable this and allow traditional password authentication. We have reviewed authentication methods settings, conditional access policies, security defaults, and user flow configurations, but cannot find a way to disable email OTP and enable password-based authentication. This creates significant friction in our authentication flow and increases authentication time as users must wait for emails, copy codes, and paste them rather than using saved passwords.

We have done the obvious on the authentication settings but if we disable OTP it just locks the B2B external user out entirely.

Answer 1

Hello David Finkelstein,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well. 

I got that External partners are forced to log in with an email code every time (OTP), but you want them to log in with a usual password or their own corporate credentials. If OTP is turned off, those guest users can’t log in at all, so either they use the cumbersome code or they get locked out. This creates a frustrating, slow login experience.

Will try to provide you some solutions, but before that will recommend you to check some points as:

Are these guests from partner companies (with Microsoft/Entra accounts) or just using their own email? check Is there any federation with their home directory, or are they just guests? What’s your end goal force all to use password + MFA, or just avoid OTP? Are you using standard B2B, B2C, or anything custom? Have users already redeemed invitations using OTP? All these clarifications will help decide if alternate sign-in methods can be enabled, or if guest access will break.

we will recommend you try below solutions as of now:

You can Only disable email OTP if all external users have another authentication route (like Microsoft/Entra accounts or federation).

To avoid OTP, ensure guests have a supported sign-in path before you switch OTP off.

To disable, go: Entra ID > External Identities > All identity providers > Email one-time passcode > set to "No".​

For guests who previously used OTP, you might need to re-invite or reset their redemption information.

All these steps and more understanding at: Email one-time passcode authentication - Microsoft Learn

And some other methods you can't do like You can’t force Azure AD/Entra B2B guests without a recognized credential or federation to use “just” a password. It’s not possible to force all guests including those with business credentials to use OTP, since their home identity takes precedence.​And Conditional Access cannot override the fallback OTP mechanism in these scenarios.

more at: https://learn.microsoft.com/en-us/entra/external-id/authentication-conditional-access

https://learn.microsoft.com/en-us/entra/external-id/user-properties

Hope this helps! If it answered your question, please consider clicking Accept Answer and Upvote. This will help us and others in the community as well.

If you need more info or if the above did not work for you, feel free to reach out in the comments with the clarification points I have asked for. Happy to help!

Regards,

Monalisha