Guest users keep getting prompted to provide OTP

Question

So we have a bit of a situation at our company, some of our guest users are complaining that they have to put in OTP every time they want to sign or access the file that was shared with them via onedrive or sharepoint

To simulate this, i created a 3rd party email, invited this account as a guest and shared a file with this account, i went through the usual registration step where i was prompted to provide OTP, registered a Microsoft Account and MFA. When I tried to access the file, the system prompted me to sign in with the OTP. I close and reopen the browser but I was not prompted this time but if i leave it for a few hours, I got the need to sign in with OTP message again.

The email one time passcode option is disabled in our tenant so I shouldn't need the OTP to sign in but that doesn't seem to be the case

I would like to know if this is the default behavior? Is there any Microsoft article to support this? Or my understanding about the whole OTP thing is wrong? Moved from: Microsoft 365 and Office | SharePoint | Open Specifications

Answer 1

Dear @Adli,

Good day. Thank you for posting your question in the Microsoft Q&A forum!

I sincerely apologize for the inconvenience you’ve experienced. I truly appreciate your patience during this time and thank you for bearing with us.

For better assist, please kindly let me know some information:

• Are these guests from partner companies (with Microsoft/Entra accounts) or just using their own email?
• Please check is there any federation with their home directory, or are they just guests?
• What’s your end goal force all to use password + MFA, or just avoid OTP? Are you using standard B2B, B2C, or anything custom?
• Have users already redeemed invitations using OTP? All these clarifications will help decide if alternate sign-in methods can be enabled, or if guest access will break.

In this case, please try these steps below and check if it helps:

• You can only disable email OTP if all external users have another authentication route (e.g. Microsoft/Entra accounts or federation).
• To avoid OTP, ensure guests have a supported sign-in path before you switch OTP off.
• To disable, please go to: Entra ID > External Identities > All identity providers > Email one-time passcode > set to "No".
• For guests who previously used OTP, you might need to re-invite or reset their redemption information.
• All these steps and more understanding at: Email one-time passcode authentication for B2B guest users
• And some other methods you can't do like You can’t force Azure AD/Entra B2B guests without a recognized credential or federation to use just a password. It’s not possible to force all guests including those with business credentials to use OTP, since their home identity takes precedence. And Conditional Access cannot override the fallback OTP mechanism in these scenarios.

For reference:

Authentication and Conditional Access for External ID

Understand and manage the properties of B2B guest users

I hope this information is helpful. Please follow these steps and let me know if it works for you. If not, we can work together to resolve this.

Thank you for your patience and your understanding. If you have any questions, please feel free to reach out.

I'm looking forward for your reply.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

The behavior you are experiencing with guest users being prompted for a one-time passcode (OTP) each time they access shared files in OneDrive or SharePoint can be attributed to the email one-time passcode feature. Even if this feature is disabled in your tenant, it may still apply under certain conditions, such as when the guest user is accessing resources from a different tenant or if their session has expired after a period of inactivity.

When a guest user accesses a shared resource for the first time, they are typically required to verify their identity using an OTP. After that, if they have registered a Microsoft account and set up multi-factor authentication (MFA), they should ideally not need to enter the OTP again unless their session expires or they are accessing the resource after a significant time lapse.

This behavior is not uncommon and can be influenced by various factors, including session timeouts and the specific configurations of your tenant's authentication policies. For more detailed information, you can refer to the following Microsoft documentation:

---

References:

• Authentication and Conditional Access for External ID
• Secure external sharing recipient experience
• A federated user is repeatedly prompted for credentials during sign-in to Microsoft 365, Azure or Intune
• Email one-time passcode authentication for B2B guest users