---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Disable email OTP for multi-factor authentication

# Disable email OTP for multi-factor authentication {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Manage how two-factor authentication is applied on your instance.
The glide.authenticate.multifactor.email.otp.enabled property controls whether a token for the second authentication factor can be sent via email. Email is considered a weak multi-factor authentication (MFA) factor which an attacker is more likely to gain access into for defeating MFA.

If the property is set to false, the user doesn't see the email OTP option on the MFA validation screen.

If the property is true:

* The email factor is shown in cases where the email factor policy is inactive and no other 2fa registered.
* The email factor is shown if the email factor policy is active and evaluated to true.
* The email factor is not shown if the email factor policy is active and evaluated to false.
{#sc-enable-email-otp-for-multi-factor-authentication__ul_hn1_pxz_43c}

## More information {#sc-enable-email-otp-for-multi-factor-authentication__section_qhx_1b1_xwb}

{#sc-enable-email-otp-for-multi-factor-authentication__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.authenticate.multifactor.email.otp.enabled |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | false |
| Default value | true |
| Category | [Authentication](https://www.servicenow.com/docs/SZIHG9SfxVh2_gyMf2ec2Q "The authentication category covers the main elements of modern authentication to confirm an entity and its claims are authentic and correct, resistant to impersonation and prevent interception of passwords.") |
| Security risk | * Severity score: 3.1 * CVSS score: Low * Security risk details: An attacker may successfully bypass MFA when they have the user's password. {#sc-enable-email-otp-for-multi-factor-authentication__ul_g1g_3sf_xwb} |
| Functional impact | Users who rely solely on the email one time passcode as their multi-factor authentication method will no longer see that option on the MFA validation screen. They must enroll an alternative factor such as an authenticator app, a hardware security key, or SMS before this property is turned off, otherwise they may be unable to complete login until an administrator enrolls an alternative factor for them. |
| Dependencies and prerequisites | None |
| References | [Email as an MFA factor](https://www.servicenow.com/docs/hAS_Tsa3xdKwyVtcGszS1A "Multi-factor authentication (MFA) with Email as a factor for your authentication.") |
[ ]

{#sc-enable-email-otp-for-multi-factor-authentication__table_ajc_b43_3kb}