SharePoint One-Time Passcode Retirement: External Links Stop Working by October 31, 2026

Microsoft is retiring SharePoint One-Time Passcode (SPO OTP) authentication for external sharing in SharePoint and OneDrive throughout October 2026, with completion expected by October 31. After retirement, any external person who opens an older “specific people” link and doesn’t have a Microsoft Entra B2B guest account in your tenant gets an access denied message. Clients, vendors and partners who have relied on those links for months or years can lose access with no warning. Admins can fix it now by identifying affected external users and creating guest accounts before the deadline.

This change is tracked as Message Center item MC1243549 and applies to every Microsoft 365 tenant: commercial, government and sovereign clouds. If your organization shares files with anyone outside the company, it affects you.

What Is Actually Retiring?

For years, SharePoint and OneDrive could authenticate external recipients in a lightweight way. You shared a file with an outside email address, and the recipient typed in a one-time code emailed to them. No guest account was ever created in your directory. SharePoint simply tracked that person on its own.

That SharePoint-only identity is what is going away.

It’s worth being precise here, because the name causes confusion. One-time passcodes as a sign-in method are not disappearing. Microsoft Entra ID’s email one-time passcode feature for B2B guests stays. When a guest has no work, school or personal Microsoft account, Entra still emails them a code. The difference is that the code now signs them in to a real guest account that lives in your Entra directory, where it can be governed, reviewed and protected by Conditional Access like any other identity.

What Is the Timeline?

Phase 1 already happened quietly in most tenants. That is why many admins haven’t noticed: anything shared since late spring already works the new way. The risk sits entirely in older links shared before Phase 1 reached your tenant.

Who Gets Locked Out?

The people at risk share three traits:

1. They are external to your organization
2. They received a “specific people” link before the Phase 1 rollout hit your tenant
3. They have never been given an Entra B2B guest account in your directory

In practice that often means your longest-standing external relationships: the accountant who receives a monthly OneDrive folder, a client reviewing project files, a vendor accessing a shared library, a board member with a document link from last year.

What does not change: external users who already have a B2B guest account keep working, and existing site-level sharing settings (for example, sites where external sharing is turned off) are unchanged.

How Do I Find Affected External Users?

SharePoint-only OTP identities are recognizable by their login name format, which follows the pattern urn:spo:guest#<email address>. They appear in each site’s hidden User Information List rather than as guests in Entra.

Using SharePoint Online Management Shell, you can check a site for them:

Connect-SPOService -Url https://<tenant>-admin.sharepoint.com
Get-SPOUser -Site https://<tenant>.sharepoint.com/sites/<site> -Limit All |
    Where-Object { $_.LoginName -like "urn:spo:guest*" } |
    Select-Object DisplayName, LoginName

Run this across sites with external sharing enabled (and OneDrive accounts that share externally) to build a list. Cross-check each email against your Entra guest users; any address without a matching guest is someone who will be locked out.

For larger tenants, a sharing and permissions report across all sites and OneDrive accounts is the more reliable approach, since external sharing is often concentrated in a handful of personal OneDrive accounts nobody is watching.

How Do I Restore or Preserve Access?

Microsoft documents two ways to restore access for an affected external user, and both work before or after the deadline:

• An admin creates a guest account for the external user in Microsoft Entra ID. Once a matching B2B guest exists, their existing links work again.
• An internal user shares or re-shares at least one file, folder or site with that external person. The new share creates the guest account automatically.

Doing this before October 31 means nobody sees an access denied page at all.

What Settings Should I Check Before the Deadline?

A few configuration details make the difference between a seamless switch and a support-ticket spike.

Confirm email one-time passcode is enabled in Entra. In the Microsoft Entra admin center under External Identities, check that email one-time passcode is not disabled. It is on by default for new tenants and for any tenant that hasn’t explicitly turned it off. If it is off, external people without a Microsoft account will have no way to sign in.

Set your privacy statement URL. On first sign-in, new guests are asked to consent to your organization’s privacy statement. Make sure the privacy statement URL is configured in Microsoft Entra ID so that screen points somewhere real.

Review Conditional Access for guests. Guests now fall under your Conditional Access policies like any other identity. One caveat from Microsoft’s documentation: authentication strength policies can’t be applied to email one-time passcode accounts, so use the “Require multifactor authentication” grant for those guests instead.

Plan guest lifecycle governance. Moving to Entra B2B is a genuine security improvement: external access becomes visible, reviewable and revocable in one place. It also means your guest count may grow quickly. Set up access reviews so guests who no longer need access are removed automatically.

Action Checklist

1. Locate MC1243549 in your Microsoft 365 admin center Message Center and note your tenant’s status.
2. Inventory SharePoint-only OTP identities (urn:spo:guest# login names) across sites and OneDrive accounts.
3. Cross-reference against Entra guest users to find who lacks a guest account.
4. Prioritize clients, vendors and partners with business-critical access.
5. Create guest accounts for them, or have the file owner re-share.
6. Confirm email one-time passcode is enabled in Entra External Identities.
7. Set the privacy statement URL in Entra ID.
8. Review Conditional Access policies that apply to guests.
9. Brief your help desk: “access denied on an old link” from an outside contact now has a known cause and fix.
10. Schedule recurring guest access reviews.

Frequently Asked Questions

Are one-time passcodes going away completely? No. Only the SharePoint-specific OTP identity is retiring. Microsoft Entra ID’s email one-time passcode for B2B guests remains, so external people without a Microsoft account can still sign in with an emailed code. The code now signs them in to a guest account in your directory.

Will links shared recently stop working? Generally no. Links shared after Phase 1 reached your tenant (around May to June 2026) already created Entra B2B guest accounts. The risk is concentrated in older “specific people” links.

An external client already sees access denied. How do we fix it? Create a guest account for their email address in Microsoft Entra ID, or have someone internally re-share any file, folder or site with them. Either action restores access to their existing links.

Does this change our site-level sharing settings? No. Sites with external sharing disabled stay disabled, and existing site-level configurations remain as they are.

Is this change a security improvement? Yes. Every external person becomes a governed identity in Entra, subject to Conditional Access, access reviews and audit. The trade-off is that you now need a plan for guest lifecycle management.

Find Out Who Is About to Lose Access

With days left before the October 31 completion date, the fastest path is a targeted review of who has external access today and how they authenticate. Calibrate 365’s OneDrive and SharePoint permissions assessment surfaces every external share across your tenant, flags the identities affected by this retirement, and gives you a clean remediation list. MSP partners can run the same assessment across their client base under their own brand.

Calibrate 365 Tenant Group | info@calibrate365.com | 603-759-8721 | calibrate365.com

This post is provided for informational purposes based on publicly available Microsoft documentation, including Message Center item MC1243549, as of October 2026. Rollout timelines and settings may change; consult the Microsoft 365 admin center Message Center and the Microsoft Entra admin center for your tenant’s current configuration.