SharePoint OTP retirement: keep guest access working with Entra B2B

SharePoint Online one-time passcode (OTP) authentication for external users is being retired, and all external sharing in SharePoint and OneDrive now runs through Microsoft Entra B2B. According to Message center post MC1243549 (updated 1 October 2026), the retirement started in mid-October 2026 and should be complete in commercial tenants by the end of November 2026. Guests who still sign in with a SharePoint verification code and have no Entra B2B guest account get access denied on older Specific people links; one guest account per email address, created by an admin or by resharing a single item, restores their access.

Who this is for and what you will have

This guide is for SharePoint, OneDrive and Microsoft Entra administrators in commercial Microsoft 365 tenants whose users share files with people outside the organization. By the end you will have:

• A clear picture of what changes for guests and what doesn't.
• A list of external people who were shared with through SharePoint OTP and have no guest account.
• Guest accounts created in advance for the people who still need access.
• Entra external collaboration and email one-time passcode settings that won't block the new sign-in path.
• A tested end-to-end guest sign-in, plus a short help desk script for the "access denied on an old link" call.

What changes and when

Microsoft is running the change in two phases, both described in MC1243549:

Two Microsoft Learn pages (the B2B integration article and the FAQ, both updated 7 October 2026) still describe the retirement as happening "during October 2026". The later Message center update moved the completion to the end of November 2026, so plan against the Message center date and expect the change to reach your tenant at any point until then. Tenants are selected automatically; you can't pick a date, opt out or scope the change to particular sites.

GCC, GCC High and DoD tenants are excluded from both phases for now. Microsoft says their dates will be published separately through Message center.

What breaks and what keeps working

The SharePoint OTP flow is the one where the recipient typed a verification code that SharePoint itself emailed them. Entra B2B also has an email one-time passcode feature, which looks similar to the guest but is a different mechanism, and it is not being retired.

What the B2B guest experience looks like

When someone in your organization shares with a new external email address, Entra creates a guest user object with a user principal name in the format emailaddress#EXT#@yourtenant.onmicrosoft.com, for example henry_contoso.com#EXT#@fabrikam.onmicrosoft.com. How the guest then signs in depends on what account they have:

• Work or school account in another Entra tenant: the guest is sent to their own organization's sign-in page, with their home tenant's branding, and then returned to your tenant. Microsoft finished rolling out this redirect by the end of 2025.
• Microsoft account or a federated identity provider such as Google federation, if you set it up: they sign in with that account.
• None of the above: if email one-time passcode is enabled, the browser says a code will be sent, the guest selects Send code, then enters the code from the email. Codes are valid for 30 minutes and the session lasts 24 hours, after which the guest gets a new code when they return.

On first redemption the guest must consent to your organization's privacy terms, so make sure a privacy statement URL is set in your Entra tenant properties. Because guests are now real directory objects, they are subject to your Conditional Access policies, Identity Protection and guest governance, and their sign-ins are logged in Entra sign-in and audit logs rather than in SharePoint.

One limitation to note: authentication strength policies in Conditional Access can't currently be applied to email one-time passcode guests. Microsoft's guidance is to use the Require multifactor authentication grant control for them instead.

Prerequisites

• SharePoint Administrator for the SharePoint Online Management Shell and tenant settings. A site admin can run the site sharing report for their own site.
• User Administrator or Guest Inviter to create guest accounts, and Authentication Policy Administrator to view or change email one-time passcode settings.
• An Entra role that can change external collaboration settings, such as External Identity Provider Administrator.
• Access to Audit in the Microsoft Purview portal if you want to search sharing events.
• The latest SharePoint Online Management Shell, and the Microsoft Graph PowerShell modules Microsoft.Graph.Identity.SignIns and Microsoft.Graph.Users.

Step 1: Check the tenant setting

In commercial tenants the integration is already on for new sharing regardless of the setting's value, but checking it tells you whether you are looking at a tenant where the setting still matters. Connect with the SharePoint Online Management Shell and read the property:

Connect-SPOService -Url https://contoso-admin.sharepoint.com
Get-SPOTenant | Select-Object EnableAzureADB2BIntegration

True means the integration is enabled; False means it isn't. Microsoft's integration article states that in commercial tenants the value no longer controls sharing behavior. In tenants where the setting still controls the integration, the documented command to turn it on is:

Set-SPOTenant -EnableAzureADB2BIntegration $true

Microsoft's documentation only describes this setting in PowerShell, not as a toggle in the SharePoint admin center. In the SharePoint admin center, review the related settings under Policies > Sharing: the organization-level sharing levels for SharePoint and OneDrive, any domain restrictions, and guest access expiration. Turning on the integration doesn't change these sharing settings; a site with external sharing off stays off.

If you previously relied on SharePoint domain restrictions, Microsoft recommends reviewing whether they should also be set in the Entra B2B allow or deny list. With B2B in use, the Entra list is enforced for invitations, so a domain has to be allowed in both places for sharing to work.

Step 2: Find external people who will lose access

Microsoft documents three ways to find affected people. Use the one that fits the size of your tenant.

Site and OneDrive sharing reports

For a SharePoint site, a site admin opens the site, selects Settings > Site usage, and in the Shared with external users section selects Run report, then chooses a library location and selects Save. You get an email with a link when the CSV is ready. For a OneDrive, open OneDrive, select Settings > OneDrive settings > More settings > Run sharing report.

Microsoft's FAQ says to use the User E-mail column to list guests invited through SharePoint OTP who don't yet have a B2B guest account. The report doesn't include links that were emailed but never clicked, or Anyone links, and it shows SharePoint groups rather than their members.

Purview audit search

For a tenant-wide view, search the audit log:

1. In the Microsoft Purview portal, open Audit.
2. Under Activities - friendly names, select Sharing and access request activities, choose a date range and select Search.
3. Select Export results > Download all results.
4. In Excel, split the AuditData column with the Power Query JSON transform, then filter Operations to SecureLinkCreated, AddedToSecureLink and SharingInvitationCreated, and filter TargetUserOrGroupType to Guest.

AddedToSecureLink carries the external email address in TargetUserOrGroupName. Audit retention limits how far back this goes, so it won't catch shares older than your retention period.

Microsoft Graph Data Connect

Large tenants can use the SharePoint datasets in Microsoft Graph Data Connect, which Microsoft lists as a way to identify affected content and users. Setting that up is outside the scope of this guide.

Once you have the email addresses, check which already have a guest account. This uses the Microsoft Graph PowerShell filter from Microsoft's guest quickstart:

Connect-MgGraph -Scopes 'User.Invite.All','User.Read.All'
Get-MgUser -Filter "Mail eq '[email protected]'"

No output means there is no guest account for that address yet.

Step 3: Set Entra external collaboration settings before you invite

Guest accounts are created by Entra, so Entra settings can block them. Review these in the Microsoft Entra admin center under Entra ID > External Identities > External collaboration settings:

• Guest invite settings: if this is set to Only users assigned to specific admin roles can invite guest users or No one in the organization can invite guest users including admins (most restrictive), your users' SharePoint shares to new people will fail. Choose the level that matches your policy, and assign the Guest Inviter role to people who need to invite without being admins. Microsoft's preparation list for MC1243549 calls this out explicitly.
• Guest user access: the default, Guest users have limited access to properties and memberships of directory objects, is suitable for most file sharing. The most restrictive option limits guests to their own profile.
• Collaboration restrictions: the allow or deny list of domains. A partner domain on the deny list can't be invited from SharePoint either.

Then check email one-time passcode under Entra ID > External Identities > All identity providers. On the Built-in tab, next to Email one-time passcode, select Configured and confirm Email one-time passcode for guests is Yes. If it is No, guests without another account are prompted to create a Microsoft account instead, which many external contacts won't do. Turning it off later also stops existing OTP guests from signing in.

For partners whose organizations use Entra, also review cross-tenant access settings, which can restrict inbound B2B collaboration per organization. See Entra cross-tenant access settings for B2B.

Step 4: Restore access for the people on your list

You have two documented options per person. Either one restores access to everything previously shared with that email address.

Option A: an admin creates the guest account. In the Microsoft Entra admin center, go to Microsoft Entra ID > Users, select New user > Invite external user, enter the Email exactly as it appears in the original share and a Display name, optionally select Send invite message, then select Review + invite and Invite. In PowerShell, the documented command is:

New-MgInvitation -InvitedUserDisplayName "Henry Ross" -InvitedUserEmailAddress [email protected] -InviteRedirectUrl "https://myapplications.microsoft.com" -SendInvitationMessage:$true

Documented output (from Microsoft's quickstart) is an object with an Id and an InviteRedeemUrl beginning https://login.microsoftonline.com/redeem?. To process a list, loop over a CSV of addresses with Import-Csv and call the same command for each row. Use an individual email address: Entra doesn't support group addresses or plus addressing (name+tag@) for invitations.

Option B: a user reshares one item. Anyone with permission to share can share any single file, folder or site with the external person. That creates the guest account through Entra B2B and restores access to previously shared items. This is the quickest fix for the help desk.

If a guest account already exists, a new share doesn't create a duplicate.

Step 5: Test with a guest account

Run this test once now and again after the retirement reaches your tenant.

1. Use an external mailbox you control that has no account in your tenant, such as an Outlook.com or Gmail address.
2. From a test site, share a document with that address using a Specific people link.
3. Confirm the guest object exists with Get-MgUser -Filter "Mail eq '<address>'" and that its user principal name contains #EXT#.
4. In a private browser window, open the link from the sharing email. Confirm you see either a redirect to the account's own sign-in page or the Send code prompt, and that the document opens after sign-in.
5. In the Entra admin center, open the guest under Microsoft Entra ID > Users and check the B2B collaboration tile in My Feed. If the state is Pending acceptance, use Resend invitation.
6. Check that the guest's sign-in appears in the Entra sign-in logs and that any guest Conditional Access policy applied as expected.

Undoing the test

There's no rollback for the retirement itself. Clean up the test with the documented command:

Remove-MgUser -UserId 'henry_contoso.com#EXT#@fabrikam.onmicrosoft.com'

If a guest needs to switch from one sign-in method to another, for example from email one-time passcode to a work account they now have, Microsoft documents resetting the guest's redemption status rather than deleting and reinviting them.

Troubleshooting

"Access denied" on a link that worked last month. The retirement has reached your tenant and the person has no matching guest account. Check the address with Get-MgUser, then create the guest or reshare one item. Watch for the person using a different address from the one originally shared with: the guest account must match the original email.

Sharing to a new external person fails. Check Guest invite settings and Collaboration restrictions in Entra. With B2B integration, the more restrictive of the Entra and SharePoint settings wins.

The guest is asked to create a Microsoft account. Email one-time passcode is turned off in All identity providers. Turn it back on if your policy allows it.

The guest is blocked by Conditional Access. Guests are now in scope for your policies. Review policies targeting all users or guests, and remember that authentication strength can't be required for email OTP guests.

Help desk script

1. Ask for the exact email address the file was originally shared with.
2. Check whether a guest account exists for it.
3. If not, reshare one item with that address or ask an admin to create the guest.
4. Ask the guest to open the original link in a private window and complete sign-in or the email code.
5. If it still fails, check the Entra sign-in logs for that guest.

Checklist

• Read MC1243549 in your Message center and note the end of November 2026 completion.
• Ran site and OneDrive sharing reports or a Purview audit search, and listed external addresses.
• Created guest accounts for people who still need access.
• Guest invite settings, Guest Inviter role assignments and domain lists reviewed in Entra.
• Email one-time passcode for guests set to Yes, unless you deliberately don't allow it.
• End-to-end test with a test guest passed, and the test guest removed.
• Help desk briefed and internal documentation updated.

For the wider sharing configuration, see SharePoint Online external sharing settings and Teams external access vs guest access.

What we checked

• Opened MC1243549 on mc.merill.net on 2026-11-12: published 4 March 2026, last updated 1 October 2026, phase 2 starting mid-October 2026 and expected to finish by the end of November 2026, with GCC, GCC High and DoD excluded.
• Compared that timeline with the Microsoft Learn B2B integration article and the OTP retirement FAQ (both updated 7 October 2026), which still say "during October 2026". We used the later Message center date and noted the difference.
• Copied Get-SPOTenant, Set-SPOTenant -EnableAzureADB2BIntegration $true and the statement that the setting no longer controls commercial tenants from the Learn integration article.
• Confirmed the email one-time passcode path (All identity providers > Built-in), the 30-minute code validity and 24-hour session from the Entra email OTP article (updated 27 March 2026).
• Copied the four Guest invite settings labels and the Guest Inviter note from the Entra external collaboration article (updated 24 April 2026).
• Documented output: the New-MgInvitation result (Id, InviteRedeemUrl) and the #EXT# user principal name format are quoted from Microsoft's PowerShell guest quickstart.
• Confirmed the site report path and User E-mail column on the sharing reports page, and the audit operation names on the Purview sharing auditing page.
• Not tested on a live tenant: steps follow Microsoft's documentation as of 2026-11-12, and the SharePoint admin center wording may differ slightly from the docs.

Last tested: 2026-11-12

References

• MC1243549, Retirement of SharePoint One-Time Passcode and transition to Microsoft Entra B2B (Message center mirror): https://mc.merill.net/message/MC1243549
• Microsoft Entra B2B integration for SharePoint and OneDrive: https://learn.microsoft.com/en-us/sharepoint/sharepoint-azureb2b-integration
• FAQ, improvements to external sharing in OneDrive and SharePoint: https://learn.microsoft.com/en-us/sharepoint/faqs-odspintegrationwithentrab2b
• Email one-time passcode authentication: https://learn.microsoft.com/en-us/entra/external-id/one-time-passcode
• Configure external collaboration settings: https://learn.microsoft.com/en-us/entra/external-id/external-collaboration-settings-configure
• Add B2B collaboration users in the admin center: https://learn.microsoft.com/en-us/entra/external-id/add-users-administrator
• Quickstart, add a guest user with PowerShell: https://learn.microsoft.com/en-us/entra/external-id/b2b-quickstart-invite-powershell
• Report on file and folder sharing in a SharePoint site: https://learn.microsoft.com/en-us/sharepoint/sharing-reports
• Use sharing auditing in the audit log: https://learn.microsoft.com/en-us/purview/audit-log-sharing