web
You’re offline. This is a read only version of the page.
close
Skip to main content

Announcements

News and Announcements icon
Community site session details

Community site session details

Session Id :
Power Platform Community / Forums / Power Automate / Advise on Retirement o...
Power Automate
Suggested Answer

Advise on Retirement of SPO OTP

(1) ShareShare
ReportReport
Posted on by 55
Hi Community,

Could anyone advise us on what would happen to our automation setup in Power Automate? 
 
One of our automations generate a link using a send HTTP request to SharePoint, which will be sent to vendors after. When a vendor accesses the link, they will be prompted to enter their email address. If it matches, an OTP will be sent to their prescribed email. 
 
It is evident that this feature will be retired. It is evident that old links will stop working. However, what I want to know is whether the future generated links by that action will work even after the update and not changing how the action works. 
 
We've already communicated to our IT team to check if the setting mentioned in this text "If your organization relies on email OTP authentication via Entra, ensure it is not disabled in Entra External ID settings. See Email OTP for B2B guests". 
 
I need anyone's help and thank you in advance!
 

Retirement of SharePoint One-Time Passcode (SPO OTP) and transition to Microsoft Entra B2B guest accounts

Introduction

We are retiring SharePoint One‑Time Passcode (SPO OTP) authentication in OneDrive and SharePoint starting July 2026. Beginning in May 2026, new external sharing invitations and authentication will start using Microsoft Entra B2B instead of SPO OTP. This transition simplifies external collaboration, aligns authentication with Microsoft identity standards, and enables consistent guest lifecycle management, governance, and Conditional Access coverage across Microsoft 365.

When this will happen

  • May 2026: Invitation and authentication for new external sharing begins transitioning to Microsoft Entra B2B. Users who previously authenticated via SPO OTP will continue to have access to specific people links even without a B2B guest account yet.
  • July 2026: Retirement of SPO OTP authentication begins. External users without a guest account get access denied on previously shared specific people links. To restore access, a guest account must be created in Entra B2B, or an allowed user must share/re-share at least one file/folder/site.
  • Retirement is expected to complete by August 31, 2026.

How this affects your organization

Who is affected

  • All Microsoft 365 tenants (commercial, government, sovereign).
  • All external users who access OneDrive or SharePoint files, folders, or sites.

What will happen

  • The EnableAzureB2BIntegration setting will no longer control external sharing behavior beginning May 2026.
  • SPO OTP authentication will retire beginning July 2026.
  • The option to disable Entra B2B integration will be removed.

Impact on external users

  • External users who already have an Entra B2B guest account in your directory:
    • No change in behavior.
  • External users without a B2B guest account:
    • Specific people links shared after changes rolled out to your tenant:
      • A guest account will be automatically created via the Entra B2B Invitation Manager.
      • Authentication will use Entra B2B (email OTP available if enabled).
    • Specific people links shared before changes rolled out to your tenant:
      • SPO OTP authentication continues until July 2026.
      • After July 2026, these users will receive access denied until a matching B2B guest account exists.

Restoring access after retirement

  • Admins can manually create a guest account for the external user at any time.
  • Alternatively, an internal user with permissions needs to share or re-share at least one file, folder, or site, which will automatically create the guest account and restore access to all previously shared content.

What you need to do to prepare

No admin action is required. However, to ensure a smooth transition:

  • Inform users that some external collaborators may see access denied beginning July 2026 for older links authenticated via SPO OTP.
  • If your organization relies on email OTP authentication via Entra, ensure it is not disabled in Entra External ID settings. See Email OTP for B2B guests.
  • Review external sharing policies and conditional access settings for guests in SharePoint and Entra admin centers.
  • Optionally, identify external collaborators without guest accounts via external sharing reports. Proactively create guest accounts to retain access.
  • Update internal documentation.

Learn more:

Compliance considerations

Compliance Question Answer
Does the change alter how existing customer data is accessed, processed, or stored? Yes. This change retires SPO OTP authentication and requires all external users to authenticate using Microsoft Entra B2B guest accounts, which alters the authentication method used to access existing SharePoint and OneDrive content.
Does the change modify Conditional Access policies or enforcement? Yes. After retirement, all external users will authenticate through Entra B2B and become fully subject to Microsoft Entra Conditional Access, Identity Protection, and guest governance policies.
Does the change provide a new way of communicating between users, tenants, or subscriptions? Yes. External sharing invitations will be routed through Microsoft Entra B2B Invitation Manager instead of SharePoint’s OTP invitation flow.
Does the change alter how admins monitor, report on, or demonstrate compliance activities? Yes. Authentication events and guest lifecycle actions will be logged through Entra audit logs rather than SPO OTP logs, changing where admins review authentication and guest access activity.
I have the same question (0)
  • Suggested answer
    trice602 Profile Picture
    16,239 Super User 2026 Season 1 on at
    Hi there!

    Yes you need to take further action. submitting a ticket to IT will not be enough.  Here are some scenarios to help understand what will happen on different dates:


    Scenario 1 – Existing link, external user already has a guest account
    Example
     
    • A vendor was invited last year
     
    • They exist in Entra ID as a B2B guest
     
    • Link was shared before May 2026


    Outcome
     
    • No disruption
     
    • Link continues to work before and after July 2026
     
    • Authentication happens through Entra B2B
     
    • Conditional Access and guest policies apply


    Scenario 2 – Existing link, external user used SPO OTP only (no guest account)
    Example
     
    • File shared in 2024 using “Specific people”
     
    • External user authenticated only via emailed OTP
     
    • No guest object in Entra ID

    Before July 2026
     
    • Link continues to work
     
    • User can still authenticate via OTP

    After July 2026
     
    • Link fails with Access Denied
     
    • Reason: SPO OTP no longer supported

    How access is restored
     
    • Admin creates a guest account, OR
     
    • Internal user re‑shares any file/folder/site to that user
     
      • This automatically creates the guest account
     
      • All previously shared content becomes accessible again


    Scenario 3 – New link created after May 2026
    Example
     
    • User shares a file externally in June 2026


    Outcome
     
    • Entra B2B guest account is automatically created
     
    • Authentication uses Entra B2B
     
    • Email OTP is available only if enabled in Entra External ID settings
     
    • Link will not break in July



    Scenario 4 – Link is forwarded to another external person
    Example
     
    • “Specific people” link forwarded to someone else

    Outcome
     
    • Forwarded recipient cannot access
     
    • Behavior unchanged from today
     
    • Sharing still requires an explicit share and guest identity
     
     

    ------------------------------------------------

     

     

    ⭐ If this was helpful, please like and check the box below "Does this answer your question" to help others find this too!

     

     

    Always glad to help! 💯💯💯💯💯

     

    Tom

     

    Follow me on LinkedIn - Thomas Rice, PMP | LinkedIn

  • apangeles_ Profile Picture
    55 on at
    Hi @trice602,
     
    Thank you for the scenarios. Understood. Just to be clear, the sharing link we're talking about is this (screenshot below): 
     
     
    Because this is the one where our Power Automate uses the send HTTP to generate a link in this section. So I guess, if this is the link we're talking about, will not affect our automations. Correct? 
     
    Understood on the Enable External ID settings.

Under review

Thank you for your reply! To ensure a great experience for everyone, your content is awaiting approval by our Community Managers. Please check back later.

Helpful resources

Quick Links

Introducing the 2026 Season 1 community Super Users

Congratulations to our 2026 Super Users!

Kudos to our 2025 Community Spotlight Honorees

Congratulations to our 2025 community superstars!

Congratulations to the April Top 10 Community Leaders!

These are the community rock stars!

Leaderboard > Power Automate

#1
Vish WR Profile Picture

Vish WR 785

#2
Valantis Profile Picture

Valantis 669

#3
Haque Profile Picture

Haque 563

Last 30 days Overall leaderboard