Stuck in Microsoft Authenticator loop (can’t sign in or enroll) and admin can’t find 2FA; how do we reset/remove MFA so I can re-enroll?

Question

Hi all,

I’m stuck in a loop with Microsoft Authenticator. Any time I try to change my password or access parts of my account, I’m prompted to approve via Microsoft Authenticator. I installed the app on my phone, but to finish setup it also asks for an Authenticator approval, so I can’t complete enrollment or sign in. Catch-22.

Context:

My CEO is the tenant admin. We checked the admin portals but couldn’t find a place showing my account has 2FA enabled.

On the legacy “Per-user MFA” page I appear not enabled, yet I’m still forced to use Authenticator at sign-in.

What we need:

Step-by-step instructions for an admin to reset/remove my existing MFA/Authenticator methods so I can sign in and re-enroll the Authenticator app cleanly.

• If this is enforced by Security Defaults or a Conditional Access policy (rather than per-user MFA), where exactly should we look and what should we change temporarily?

Goal:
Let me sign in once (without an existing Authenticator approval), re-enroll Microsoft Authenticator on my phone, and then proceed to update my password/security settings.

Thanks in advance!

Best regards,
Denis

Answer 1

Hi @Denis

Welcome to Q&A Community! 

I understand that you're having a Business account with User permission and can't sign in to your account because of MFA.  

If this is the case, kindly ask your Admin to reset your MFA settings through the Microsoft Entra Admin Center. He needs to evoke MFA sessions and require re-register in the Microsoft Entra admin center. 

Please have your administrator follow the steps shown in the following article: Manage authentication methods for Microsoft Entra multi-factor authentication - Microsoft Entra ID | Microsoft Learn 

1. Sign in to the Microsoft Entra admin center as at least one Authentication Administrator. 
2. Navigate to User -> All user.  Select the user you want to act on, and select Authentication methods. then select Require re-register of multi-factor authentication.  
3. Require re-register MFA: This disables all previous authentication methods. You'll then be prompted to configure a new MFA authentication method the next time you try to sign in, so you can add a new authenticator app.  

To check if MFA is enforced by Security Defaults, Conditional Access or Per-user MFA, kindly follow this instruction. 

• Security Defaults: 

In Entra Admin Center, go to Identity → Overview → Properties → Manage security defaults. 

For reference: Configure Security Defaults for Microsoft Entra ID - Microsoft Entra | Microsoft Learn 

• Conditional Access Policies: 
  1. Sign in to the Microsoft Entra admin center as at least a Reports Reader. 
  2. Browse to Entra ID > Monitoring & health > Sign-in logs. 
  3. Select a sign-in item from the table to view the sign-in details pane. 
  4. Select the Conditional Access tab. 

For reference: Conditional Access and Microsoft Entra activity logs - Microsoft Entra ID | Microsoft Learn 

Please avoid from enabling or enforcing per-user Microsoft Entra multifactor authentication if you use Conditional Access policies. Users can only choose either Security Defaults, Conditional Access or Per-user MFA. 

For reference: Enable per-user multifactor authentication - Microsoft Entra ID | Microsoft Learn 

I hope the given information is clear and help you resolve the issue. Let me know if there are any updates or further concerns. I am happy to help. 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.