Back to Checks
m365

Email One-Time Passcode authentication method is disabled in the tenant

entra_authentication_method_email_otp_disabled
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft Entra tenant's authentication methods policy should have the Email OTP authentication method disabled. Email one-time passcodes depend on the security of the recipient mailbox, which is typically a lower-assurance channel, and should not be used as a primary or fallback multi-factor authentication method for members.

Prowler logoProwlerprowler-provider-m365

Risk

Email OTP is vulnerable to mailbox compromise and phishing. If an attacker gains access to a user's mailbox, they can intercept one-time passcodes and bypass MFA, gaining unauthorized access to the tenant.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_authentication_method_email_otp_disabled

Recommendation

Disable the Email OTP authentication method and require phishing-resistant MFA methods such as FIDO2 security keys or Microsoft Authenticator across the tenant.

Remediation

Other

1Navigate to the Microsoft Entra admin center at https://entra.microsoft.com/
2Go to **Protection** > **Authentication methods** > **Policies**
3Select **Email OTP** and set its status to **Disabled**, then click **Save**
4Ensure users have phishing-resistant MFA methods configured (e.g., FIDO2, Microsoft Authenticator)

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client


class entra_authentication_method_email_otp_disabled(Check):
    """
    Ensure that the Email One-Time Passcode (OTP) authentication method is disabled.

    This check verifies that the tenant's authentication methods policy has the Email OTP
    method disabled. Email OTP relies on the security of the mailbox, which is often a
    lower-assurance channel and is unsuitable as a primary or fallback MFA method.

    - PASS: Email OTP authentication method is disabled.
    - FAIL: Email OTP authentication method is enabled.
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the Email OTP authentication method check.

        Returns:
            A list with a single report containing the result of the check.
        """
        findings = []
        configs = entra_client.authentication_method_configurations

        email_config = configs.get("Email")

        if email_config:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=email_config,
                resource_name="Email OTP Authentication Method",
                resource_id=entra_client.tenant_domain,
            )

            if email_config.state == "disabled":
                report.status = "PASS"
                report.status_extended = (
                    "Email OTP authentication method is disabled in the tenant."
                )
            elif email_config.state == "enabled":
                report.status = "FAIL"
                report.status_extended = (
                    "Email OTP authentication method is enabled in the tenant."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    "Email OTP authentication method state could not be determined; "
                    "treating as enabled/non-compliant."
                )

            findings.append(report)

        return findings

References