---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enable email OTP for multi-factor authentication

# Enable email OTP for multi-factor authentication {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Manage how two-factor authentication is applied on your instance.
The property glide.authenticate.multifactor.email.otp.enabled controls whether a token for the second authentication factor can be sent via email. Email is considered a weak MFA factor which an attacker is more
likely to gain access into for defeating MFA.

If the property is false, the user doesn't see email OTP option on the MFA validation screen.

If the property is true:

1. The email factor is shown in cases where the email factor policy is inactive and no other 2fa registered.
2. The email factor is shown if the email factor policy is active and evaluated to true.
3. The email factor is not shown if the email factor policy is active and evaluated to false.
{#sc-enable-email-otp-for-multi-factor-authentication__ol_hn1_pxz_43c}

## More information {#sc-enable-email-otp-for-multi-factor-authentication__section_qhx_1b1_xwb}

{#sc-enable-email-otp-for-multi-factor-authentication__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.authenticate.multifactor.email.otp.enabled |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | false |
| Default value | true |
| Category | [Authentication](https://www.servicenow.com/docs/b9CEYnMpryNiLMZU_fh~Tw "The authentication category covers the main elements of modern authentication to confirm an entity and its claims are authentic and correct, resistant to impersonation and prevent interception of passwords.") |
| Security risk | * Severity score: 3.1 * CVSS score: Low * Security risk details: An attacker may successfully bypassing MFA when they have the user's password. {#sc-enable-email-otp-for-multi-factor-authentication__ul_g1g_3sf_xwb} |
| Dependencies and prerequisites | None |
| References | [Email as an MFA factor](https://www.servicenow.com/docs/iUQsZDkp9ddfPMD76uJIAw "Multi-factor authentication (MFA) with Email as a factor for your authentication.") |
[ ]

{#sc-enable-email-otp-for-multi-factor-authentication__table_ajc_b43_3kb}