# SharePoint OTP retirement: keep guest access working with Entra B2B

> SharePoint one-time passcode sign-in for guests ends by late November 2026 (MC1243549). Find guests without B2B accounts, restore access and test the new Entra B2B sign-in.

Source: https://www.epifive.com/blog/sharepoint-otp-retirement-entra-b2b-guest-access · Published 2026-11-12 · EpiFive

## Key takeaways

- SharePoint Online OTP retirement began in mid-October 2026 and is expected to complete by the end of November 2026 in commercial tenants, per MC1243549.
- External users who opened Specific people links through SharePoint OTP and have no Entra B2B guest account get access denied after the retirement reaches the tenant.
- Creating one guest account for the original email address, or resharing any single item, restores access to everything previously shared with that person.
- Entra B2B email one-time passcode is not retiring and should stay enabled if your partners have no Entra or Microsoft account.
- The change is tenant-wide with no opt-out, no date choice and no site-level exception.

SharePoint Online one-time passcode (OTP) authentication for external users is being retired, and all external sharing in SharePoint and OneDrive now runs through Microsoft Entra B2B. According to Message center post MC1243549 (updated 1 October 2026), the retirement started in mid-October 2026 and should be complete in commercial tenants by the end of November 2026. Guests who still sign in with a SharePoint verification code and have no Entra B2B guest account get access denied on older **Specific people** links; one guest account per email address, created by an admin or by resharing a single item, restores their access.

## Who this is for and what you will have

This guide is for SharePoint, OneDrive and Microsoft Entra administrators in commercial Microsoft 365 tenants whose users share files with people outside the organization. By the end you will have:

- A clear picture of what changes for guests and what doesn't.
- A list of external people who were shared with through SharePoint OTP and have no guest account.
- Guest accounts created in advance for the people who still need access.
- Entra external collaboration and email one-time passcode settings that won't block the new sign-in path.
- A tested end-to-end guest sign-in, plus a short help desk script for the "access denied on an old link" call.

## What changes and when

Microsoft is running the change in two phases, both described in MC1243549:

| Phase | Timing (commercial tenants) | Effect |
|---|---|---|
| 1. New sharing uses Entra B2B | May to July 2026, fully rolled out | New external sharing invitations create Entra B2B guest accounts through the B2B Invitation Manager. `EnableAzureADB2BIntegration` no longer controls sharing behavior, and the integration can't be turned off. |
| 2. SharePoint OTP retired | Started mid-October 2026, expected complete by end of November 2026 | External users without a matching guest account get access denied on previously shared Specific people links. |

Two Microsoft Learn pages (the B2B integration article and the FAQ, both updated 7 October 2026) still describe the retirement as happening "during October 2026". The later Message center update moved the completion to the end of November 2026, so plan against the Message center date and expect the change to reach your tenant at any point until then. Tenants are selected automatically; you can't pick a date, opt out or scope the change to particular sites.

GCC, GCC High and DoD tenants are excluded from both phases for now. Microsoft says their dates will be published separately through Message center.

### What breaks and what keeps working

| External person | After retirement reaches the tenant |
|---|---|
| Already has an Entra B2B guest account in your directory | No change. Previously shared links keep working. |
| Shared with after phase 1, no previous account | A guest account was created automatically at sharing time. No change. |
| Shared with before phase 1 through SharePoint OTP, no guest account | **Access denied** on previously shared Specific people links until a matching guest account exists. |
| Uses an Anyone link | Not affected. |

The SharePoint OTP flow is the one where the recipient typed a verification code that SharePoint itself emailed them. Entra B2B also has an **email one-time passcode** feature, which looks similar to the guest but is a different mechanism, and it is not being retired.

## What the B2B guest experience looks like

When someone in your organization shares with a new external email address, Entra creates a guest user object with a user principal name in the format `emailaddress#EXT#@yourtenant.onmicrosoft.com`, for example `henry_contoso.com#EXT#@fabrikam.onmicrosoft.com`. How the guest then signs in depends on what account they have:

- **Work or school account in another Entra tenant**: the guest is sent to their own organization's sign-in page, with their home tenant's branding, and then returned to your tenant. Microsoft finished rolling out this redirect by the end of 2025.
- **Microsoft account or a federated identity provider** such as Google federation, if you set it up: they sign in with that account.
- **None of the above**: if email one-time passcode is enabled, the browser says a code will be sent, the guest selects **Send code**, then enters the code from the email. Codes are valid for 30 minutes and the session lasts 24 hours, after which the guest gets a new code when they return.

On first redemption the guest must consent to your organization's privacy terms, so make sure a privacy statement URL is set in your Entra tenant properties. Because guests are now real directory objects, they are subject to your Conditional Access policies, Identity Protection and guest governance, and their sign-ins are logged in Entra sign-in and audit logs rather than in SharePoint.

One limitation to note: authentication strength policies in Conditional Access can't currently be applied to email one-time passcode guests. Microsoft's guidance is to use the **Require multifactor authentication** grant control for them instead.

## Prerequisites

- **SharePoint Administrator** for the SharePoint Online Management Shell and tenant settings. A site admin can run the site sharing report for their own site.
- **User Administrator** or **Guest Inviter** to create guest accounts, and **Authentication Policy Administrator** to view or change email one-time passcode settings.
- An Entra role that can change external collaboration settings, such as **External Identity Provider Administrator**.
- Access to **Audit** in the Microsoft Purview portal if you want to search sharing events.
- The latest SharePoint Online Management Shell, and the Microsoft Graph PowerShell modules `Microsoft.Graph.Identity.SignIns` and `Microsoft.Graph.Users`.

## Step 1: Check the tenant setting

In commercial tenants the integration is already on for new sharing regardless of the setting's value, but checking it tells you whether you are looking at a tenant where the setting still matters. Connect with the SharePoint Online Management Shell and read the property:

```powershell
Connect-SPOService -Url https://contoso-admin.sharepoint.com
Get-SPOTenant | Select-Object EnableAzureADB2BIntegration
```

`True` means the integration is enabled; `False` means it isn't. Microsoft's integration article states that in commercial tenants the value no longer controls sharing behavior. In tenants where the setting still controls the integration, the documented command to turn it on is:

```powershell
Set-SPOTenant -EnableAzureADB2BIntegration $true
```

Microsoft's documentation only describes this setting in PowerShell, not as a toggle in the SharePoint admin center. In the SharePoint admin center, review the related settings under **Policies** > **Sharing**: the organization-level sharing levels for SharePoint and OneDrive, any domain restrictions, and guest access expiration. Turning on the integration doesn't change these sharing settings; a site with external sharing off stays off.

If you previously relied on SharePoint domain restrictions, Microsoft recommends reviewing whether they should also be set in the Entra B2B allow or deny list. With B2B in use, the Entra list is enforced for invitations, so a domain has to be allowed in both places for sharing to work.

## Step 2: Find external people who will lose access

Microsoft documents three ways to find affected people. Use the one that fits the size of your tenant.

### Site and OneDrive sharing reports

For a SharePoint site, a site admin opens the site, selects **Settings** > **Site usage**, and in the **Shared with external users** section selects **Run report**, then chooses a library location and selects **Save**. You get an email with a link when the CSV is ready. For a OneDrive, open OneDrive, select **Settings** > **OneDrive settings** > **More settings** > **Run sharing report**.

Microsoft's FAQ says to use the **User E-mail** column to list guests invited through SharePoint OTP who don't yet have a B2B guest account. The report doesn't include links that were emailed but never clicked, or Anyone links, and it shows SharePoint groups rather than their members.

### Purview audit search

For a tenant-wide view, search the audit log:

1. In the Microsoft Purview portal, open **Audit**.
2. Under **Activities - friendly names**, select **Sharing and access request activities**, choose a date range and select **Search**.
3. Select **Export results** > **Download all results**.
4. In Excel, split the **AuditData** column with the Power Query JSON transform, then filter **Operations** to `SecureLinkCreated`, `AddedToSecureLink` and `SharingInvitationCreated`, and filter **TargetUserOrGroupType** to `Guest`.

`AddedToSecureLink` carries the external email address in **TargetUserOrGroupName**. Audit retention limits how far back this goes, so it won't catch shares older than your retention period.

### Microsoft Graph Data Connect

Large tenants can use the SharePoint datasets in Microsoft Graph Data Connect, which Microsoft lists as a way to identify affected content and users. Setting that up is outside the scope of this guide.

Once you have the email addresses, check which already have a guest account. This uses the Microsoft Graph PowerShell filter from Microsoft's guest quickstart:

```powershell
Connect-MgGraph -Scopes 'User.Invite.All','User.Read.All'
Get-MgUser -Filter "Mail eq 'henry@contoso.com'"
```

No output means there is no guest account for that address yet.

## Step 3: Set Entra external collaboration settings before you invite

Guest accounts are created by Entra, so Entra settings can block them. Review these in the Microsoft Entra admin center under **Entra ID** > **External Identities** > **External collaboration settings**:

- **Guest invite settings**: if this is set to **Only users assigned to specific admin roles can invite guest users** or **No one in the organization can invite guest users including admins (most restrictive)**, your users' SharePoint shares to new people will fail. Choose the level that matches your policy, and assign the **Guest Inviter** role to people who need to invite without being admins. Microsoft's preparation list for MC1243549 calls this out explicitly.
- **Guest user access**: the default, **Guest users have limited access to properties and memberships of directory objects**, is suitable for most file sharing. The most restrictive option limits guests to their own profile.
- **Collaboration restrictions**: the allow or deny list of domains. A partner domain on the deny list can't be invited from SharePoint either.

Then check email one-time passcode under **Entra ID** > **External Identities** > **All identity providers**. On the **Built-in** tab, next to **Email one-time passcode**, select **Configured** and confirm **Email one-time passcode for guests** is **Yes**. If it is **No**, guests without another account are prompted to create a Microsoft account instead, which many external contacts won't do. Turning it off later also stops existing OTP guests from signing in.

For partners whose organizations use Entra, also review cross-tenant access settings, which can restrict inbound B2B collaboration per organization. See [Entra cross-tenant access settings for B2B](https://www.epifive.com/blog/entra-cross-tenant-access-settings-b2b).

## Step 4: Restore access for the people on your list

You have two documented options per person. Either one restores access to everything previously shared with that email address.

**Option A: an admin creates the guest account.** In the Microsoft Entra admin center, go to **Microsoft Entra ID** > **Users**, select **New user** > **Invite external user**, enter the **Email** exactly as it appears in the original share and a **Display name**, optionally select **Send invite message**, then select **Review + invite** and **Invite**. In PowerShell, the documented command is:

```powershell
New-MgInvitation -InvitedUserDisplayName "Henry Ross" -InvitedUserEmailAddress henry@contoso.com -InviteRedirectUrl "https://myapplications.microsoft.com" -SendInvitationMessage:$true
```

Documented output (from Microsoft's quickstart) is an object with an `Id` and an `InviteRedeemUrl` beginning `https://login.microsoftonline.com/redeem?`. To process a list, loop over a CSV of addresses with `Import-Csv` and call the same command for each row. Use an individual email address: Entra doesn't support group addresses or plus addressing (`name+tag@`) for invitations.

**Option B: a user reshares one item.** Anyone with permission to share can share any single file, folder or site with the external person. That creates the guest account through Entra B2B and restores access to previously shared items. This is the quickest fix for the help desk.

If a guest account already exists, a new share doesn't create a duplicate.

## Step 5: Test with a guest account

Run this test once now and again after the retirement reaches your tenant.

1. Use an external mailbox you control that has no account in your tenant, such as an Outlook.com or Gmail address.
2. From a test site, share a document with that address using a **Specific people** link.
3. Confirm the guest object exists with `Get-MgUser -Filter "Mail eq '<address>'"` and that its user principal name contains `#EXT#`.
4. In a private browser window, open the link from the sharing email. Confirm you see either a redirect to the account's own sign-in page or the **Send code** prompt, and that the document opens after sign-in.
5. In the Entra admin center, open the guest under **Microsoft Entra ID** > **Users** and check the **B2B collaboration** tile in **My Feed**. If the state is **Pending acceptance**, use **Resend invitation**.
6. Check that the guest's sign-in appears in the Entra sign-in logs and that any guest Conditional Access policy applied as expected.

### Undoing the test

There's no rollback for the retirement itself. Clean up the test with the documented command:

```powershell
Remove-MgUser -UserId 'henry_contoso.com#EXT#@fabrikam.onmicrosoft.com'
```

If a guest needs to switch from one sign-in method to another, for example from email one-time passcode to a work account they now have, Microsoft documents resetting the guest's redemption status rather than deleting and reinviting them.

## Troubleshooting

**"Access denied" on a link that worked last month.** The retirement has reached your tenant and the person has no matching guest account. Check the address with `Get-MgUser`, then create the guest or reshare one item. Watch for the person using a different address from the one originally shared with: the guest account must match the original email.

**Sharing to a new external person fails.** Check **Guest invite settings** and **Collaboration restrictions** in Entra. With B2B integration, the more restrictive of the Entra and SharePoint settings wins.

**The guest is asked to create a Microsoft account.** Email one-time passcode is turned off in **All identity providers**. Turn it back on if your policy allows it.

**The guest is blocked by Conditional Access.** Guests are now in scope for your policies. Review policies targeting all users or guests, and remember that authentication strength can't be required for email OTP guests.

## Help desk script

1. Ask for the exact email address the file was originally shared with.
2. Check whether a guest account exists for it.
3. If not, reshare one item with that address or ask an admin to create the guest.
4. Ask the guest to open the original link in a private window and complete sign-in or the email code.
5. If it still fails, check the Entra sign-in logs for that guest.

## Checklist

- Read MC1243549 in your Message center and note the end of November 2026 completion.
- Ran site and OneDrive sharing reports or a Purview audit search, and listed external addresses.
- Created guest accounts for people who still need access.
- Guest invite settings, Guest Inviter role assignments and domain lists reviewed in Entra.
- Email one-time passcode for guests set to **Yes**, unless you deliberately don't allow it.
- End-to-end test with a test guest passed, and the test guest removed.
- Help desk briefed and internal documentation updated.

For the wider sharing configuration, see [SharePoint Online external sharing settings](https://www.epifive.com/blog/sharepoint-external-sharing-settings-guide) and [Teams external access vs guest access](https://www.epifive.com/blog/teams-external-access-vs-guest-access).

## What we checked

- Opened MC1243549 on mc.merill.net on 2026-11-12: published 4 March 2026, last updated 1 October 2026, phase 2 starting mid-October 2026 and expected to finish by the end of November 2026, with GCC, GCC High and DoD excluded.
- Compared that timeline with the Microsoft Learn B2B integration article and the OTP retirement FAQ (both updated 7 October 2026), which still say "during October 2026". We used the later Message center date and noted the difference.
- Copied `Get-SPOTenant`, `Set-SPOTenant -EnableAzureADB2BIntegration $true` and the statement that the setting no longer controls commercial tenants from the Learn integration article.
- Confirmed the email one-time passcode path (**All identity providers** > **Built-in**), the 30-minute code validity and 24-hour session from the Entra email OTP article (updated 27 March 2026).
- Copied the four **Guest invite settings** labels and the Guest Inviter note from the Entra external collaboration article (updated 24 April 2026).
- Documented output: the `New-MgInvitation` result (`Id`, `InviteRedeemUrl`) and the `#EXT#` user principal name format are quoted from Microsoft's PowerShell guest quickstart.
- Confirmed the site report path and **User E-mail** column on the sharing reports page, and the audit operation names on the Purview sharing auditing page.
- Not tested on a live tenant: steps follow Microsoft's documentation as of 2026-11-12, and the SharePoint admin center wording may differ slightly from the docs.

Last tested: 2026-11-12

## References

- MC1243549, Retirement of SharePoint One-Time Passcode and transition to Microsoft Entra B2B (Message center mirror): https://mc.merill.net/message/MC1243549
- Microsoft Entra B2B integration for SharePoint and OneDrive: https://learn.microsoft.com/en-us/sharepoint/sharepoint-azureb2b-integration
- FAQ, improvements to external sharing in OneDrive and SharePoint: https://learn.microsoft.com/en-us/sharepoint/faqs-odspintegrationwithentrab2b
- Email one-time passcode authentication: https://learn.microsoft.com/en-us/entra/external-id/one-time-passcode
- Configure external collaboration settings: https://learn.microsoft.com/en-us/entra/external-id/external-collaboration-settings-configure
- Add B2B collaboration users in the admin center: https://learn.microsoft.com/en-us/entra/external-id/add-users-administrator
- Quickstart, add a guest user with PowerShell: https://learn.microsoft.com/en-us/entra/external-id/b2b-quickstart-invite-powershell
- Report on file and folder sharing in a SharePoint site: https://learn.microsoft.com/en-us/sharepoint/sharing-reports
- Use sharing auditing in the audit log: https://learn.microsoft.com/en-us/purview/audit-log-sharing

## Frequently asked questions

### When is SharePoint one-time passcode authentication retired?

Message center post MC1243549, updated 1 October 2026, says the retirement of SharePoint Online OTP started in mid-October 2026 and is expected to finish by the end of November 2026 for commercial tenants. GCC, GCC High and DoD are excluded and get their own dates later. You can't choose the date for your tenant or opt out.

### Is Entra B2B email one-time passcode being retired too?

No. Only the SharePoint Online OTP mechanism is retiring. Microsoft Entra B2B email one-time passcode stays supported and is the fallback for guests who have no Entra, Microsoft or federated account. It is on by default unless an admin explicitly turned it off.

### Why does an external user now get access denied on an old link?

The person opened a Specific people link through SharePoint OTP and has no matching Entra B2B guest account in your directory. Once the retirement reaches your tenant, those links deny access. Create a guest account for the email address the item was shared with, or share any one file, folder or site with the person again, and access to everything previously shared with them comes back.

### Do I have to reshare every file with every guest?

No. One matching guest account restores access to all items previously shared with that email address. Microsoft's FAQ says you don't need to reshare items individually and that no duplicate guest account is created if one already exists.

### Are Anyone links affected by the OTP retirement?

No. Microsoft's FAQ states that the SharePoint OTP retirement and the move to Entra B2B don't affect Anyone (anonymous) links. They keep following your Anyone link settings, such as expiry and permissions.