Loop with the Block Basic Authentication Prompts (already 1 hr waiting fr support)

Question

Hi all,

I'm trying to login to my azure portal with my admin account, even though the MFA authentication via app is setup in my profile, It won't let me login and asks for Phone and other method's which are in conflict with the " block basic authentication prompts" and therefore I cannot login anymore. *I'm waiting on the line for microsoft to help me out with this (60 minutes in waiting as of now) but I hope that some of you brilliant minds can help me out here, what did I miss..

I think is is the reason why the lock is been initiated, Somehow Microsoft doesn't recognise my account has the MFA already activated, and pushes for basic authentication, which is blocked by the following policy. Which is irreversible by the way, and now I' m not able to login at all...When you go to the link in this page you' ll get no policies and a message "we are sorry but we are not accepting new preview customers at this time " Like huh?! Pls assist!

Answer 1

Hello Marthine Ruitenberg,

This is not a basic authentication issue. You’re stuck in an MFA method enforcement loop caused by Conditional Access / Security Defaults combined with the “Block weaker/legacy authentication prompts” setting.

Even though Microsoft Authenticator is registered, Entra ID is enforcing a stronger authentication requirement and is attempting to prompt for additional methods (phone/alternate). Because those prompts are blocked, the sign‑in can’t complete, resulting in a full admin lockout.

The message “we are not accepting new preview customers” is expected — the Per‑User MFA (Preview) blade is deprecated and no longer accepts new tenants. MFA is now enforced only via Security Defaults or Conditional Access, so this message is unrelated to the lockout.

Unfortunately, there is no self‑service recovery once all Global Admins are blocked and no break‑glass account exists. The only supported resolution needs to forward to the data protection team.

Once access is restored, Microsoft strongly recommends maintaining at least two break‑glass admin accounts excluded from MFA/CA to prevent this scenario in the future.