I encountered this problem on an Exchange account that I have administrator access to (via Microsoft admin panel).
The solution for me was:
(1) Go to admin.microsoft.com and sign into administrator account
(2) Click "Show all" on left side
(3) Click Identity (left side)
(4) Click Users (left side)
(5) Click "All users" (left side, underneath user)
(6) Select the account of the user w/ the problem
(7) Click "Authentication Methods" ( in the column on the left in the new area -- kind of a new middle-left column)
(8) "Revoke Multifactor Authentication Sessions" (from top bar)
(9) "Require re-register Multifactor Authentication" (from top bar)
(10) Now open a new "private browsing tab" (or if the user isn't you, you can have them do it)
a. Go to office.com
b. Begin signin - I suggest picking "use-a-different-authenticator" and using Google, but anyway
c. You'll do the usual scan-the-code procedure to configure Google Authenticator (or Microsoft Authenticator if you're bold)
d. After that user should be good to go signing in on their iphone