Developer replaced their phone and can use Microsoft Authenticator for other sites but not Azure Portal

Question

Developer replaced their phone and can use Microsoft Authenticator for other sites but not Azure Portal

Luke Chung 41 MVP

One of our developers replaced their Android phone and can no longer use the Microsoft Authenticator to log into the Azure Portal. No authentication is requested in the app. The Authenticator works for other Microsoft platforms like OneDrive and Office.

What does Azure need differently?

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hello Luke Chung,

Based on your description, it appears that your developer unable to log into the Azure Portal due to an incomplete MFA process. Since the device registered for second-factor authentication are not getting any MFA prompts, you are unable to complete the authentication.

The reason he is able to complete MFA for OneDrive and Office, but not for Azure, is likely because the affected user account is a Personal Microsoft Account (MSA). Personal Microsoft Accounts have their own separate MFA registration, which is different from the MFA registration used for Azure work or school accounts. As a result, MFA set up for an MSA will not carry over to an Azure (work/school) account, and vice versa.

To fix this issue, you need to reset MFA on affected user account by logging in with another global administrator account into that tenant.

Please share the following steps with another Global Administrator in the tenant to reset your MFA settings:

Sign in to the Microsoft Entra admin center as an Authentication Administrator (or higher).
Navigate to Identity > Users > All users.
Select the affected user, then choose Authentication methods.
At the top of the window, click on "Require re-register MFA".

Screenshot of manage authentication methods from the Microsoft Entra admin center.

After this is done, you should be able to sign in again and register a new MFA authentication method when prompted.

If you're the only Global Administrator in the tenant, this qualifies as a tenant lockout scenario. In that case, we’ll need to involve Microsoft’s Data Protection team through a support ticket to help restore access.

To proceed, I’ll need a few details from you. Since this information contains personally identifiable information (PII), please send the following via private message:

Contact phone number (with country code)
Contact email address
Affected Global Admin email address
Country
Time zone

Once received, we can connect offline to discuss further steps and assist in resolving the issue.