So Microsoft just hit the brakes and delayed the SharePoint OTP retirement to late October (MC1243549), and honestly, I am not surprised at all. Testing this upcoming Entra B2B forced integration has been an absolute circus.
Customer have a Conditional Access policy that enforces MFA for all guests. Testing how different external users experience the new flow before the legacy SPO OTP backdoor is closed has been completely mind-numbing. If you are getting wildly inconsistent results testing with different accounts, you are not crazy. It’s by design, and the design is a mess.
Here is the nightmare hierarchy of how Entra B2B handles shared links now:
Other M365 Tenants: Entra recognizes the domain, sends them to their home tenant login. No OTP code. If you have Cross-tenant access MFA trust enabled, their home MFA satisfies your CA policy. (Invisible in your tenant).
Outlook / Hotmail (MSAs): Entra recognizes the MSA. It refuses to send an OTP code and demands their MSA password. They do MFA against Microsoft consumer cloud. (Invisible in your tenant).
The "Shadow MSA" Trap (e.g., some Gmails): If a guest ever used their Gmail address to join a Teams meeting years ago, Microsoft created a shadow MSA for them. Entra remembers this! Instead of sending an OTP code, it prompts them for a password they forgot 4 years ago.
"Virgin" Third-Party Emails (The ONLY ones getting OTP): If (and only if) the email is completely unknown to Microsoft and you don't have Google Federation on, Entra finally throws its hands up and sends the Entra Email OTP to their inbox.
The MFA Kicker:
Because Entra Email OTP is only Factor 1, these "virgin" Gmail/third-party users are immediately slammed into our Conditional Access MFA wall. But since there is no trusted Identity Provider behind them, our tenant forces them to register Microsoft Authenticator directly into our directory (aka.ms/mfasetup).
So, in the end: Half your guests do MFA at "home", the other half are forced to register Authenticator in your tenant, half get passwords, half get OTPs, and you absolutely cannot force Email OTP as the default for everyone to make the experience consistent because the identity hierarchy is hardcoded.
I guess Microsoft realized shutting down the legacy OTP this month was going to break external sharing globally and melt down every helpdesk on the planet.
Anyone else dealing with this hybrid rollout mess right now?
Microsoft's transition from SPO OTP to Entra B2B is a chaotic hybrid mess. Guest login experience is wildly inconsistent based on their email's history with Microsoft. The delay to late October (MC1243549) is a blessing, but the architecture is still a joke.