Entra external tenant change default MFA option

Question

Entra external tenant change default MFA option

Aishah-9120 20

I have an external tenant with a conditional access policy that requires MFA for users in a certain group.

I have enabled both Email OTP and SMS-based authentication as methods. I have noticed that Entra defaults to using SMS instead of email OTP and the user needs to click "Use a different verification option" to use Email OTP.

Would it be possible to change the default? SMS was only enabled to be a fallback for users who don't have a home tenant and use Email OTP as a first-factor method of authentication.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Sridevi Machavarapu 32,000 Microsoft External Staff Moderator

Hello Aishah,

At this time, Microsoft Entra External ID does not provide a way to control which MFA method is selected by default when multiple methods are available.

If both Email OTP and SMS OTP are enabled, the default method is determined by the service. Users can choose "Use a different verification option" to switch to Email OTP, but administrators cannot configure Email OTP to be presented first.

In your scenario, SMS can remain available as a backup method, but there is currently no setting in Conditional Access, Authentication Methods, or External ID to prioritize Email OTP over SMS.

If you want users to always use Email OTP, the only option would be to disable SMS authentication. However, this would remove SMS as a fallback method.

So, what you're seeing is expected behavior and not a misconfiguration. This is currently a product limitation rather than a configuration issue. If the ability to prioritize MFA methods is important for your scenario, you may consider submitting feedback through the Microsoft Feedback Portal.

Sridevi Machavarapu 32,000 Reputation points Microsoft External Staff Moderator

2026-06-04T13:32:31.86+00:00

Hello Aishah,

Please confirm if you still have further queries on this
Aishah-9120 20 Reputation points

2026-06-04T13:35:53.49+00:00

Is it possible to figure out whether an invited user has a home tenant when they are invited to Entra?
Sridevi Machavarapu 32,000 Reputation points Microsoft External Staff Moderator

2026-06-04T13:51:58.9333333+00:00

Hello Aishah,

Not before the invitation is redeemed.

When you invite a guest user, Microsoft Entra creates the guest object and sends the invitation, but it does not expose a way to determine in advance whether the email address is backed by a home Entra tenant. The authentication path is determined during the invitation redemption process.

After the user redeems the invitation, you can inspect the guest user's identity information in Microsoft Entra ID or Microsoft Graph to understand how they authenticated. For example, users from another Entra tenant will have an external Entra identity associated with their account, while users redeeming through Email OTP will use an email-based identity provider.

So, if your goal is to identify whether a user has a home tenant before they accept the invitation, that isn't currently supported. The information becomes available only after the redemption process is completed.

Share via

Entra external tenant change default MFA option

0 additional answers

Your answer