A multicast control method in an Ethernet passive optical network, the method includes steps: (A) configuring different id for user-end devices and their user ports; labeling users on office-end devices by using id for user-end devices and their user ports; setting up user's multicast authorization table; (B) based on the multicast authorization table, office-end devices control user's multicast authority; based on the controlled result, setting up multicast filtration tables and user filtration tables for user-end devices; based on the multicast filtration tables and user filtration tables, user-end devices filter multicast data, and forward them to users having multicast authority. The method controls multicast for different user ports on the same user-end device so as to raise security of multicast.