Authenticator Verification Loop

Question

Reposting here from the general community forum.

I work for a small non-profit with minimal tech infrastructure. Everything we do is piecemeal and intermittent and we have had quite a bit of turnover, so some information is hard to come by internally, and it's not even clear what names are associated with our account in an admin role.

We are no longer able to access our Microsoft account due to some hiccup in our 2FA setup with the Authenticator app. We rarely have to access our Microsoft account, except for when we need to retrieve new Office licenses purchased through Techsoup.

Another staff member got us initially set up with the Authenticator app a few years ago and it seemed fine for a while, but something must not have been completed or set up right, because now we cannot access the account at all.

Logging in in-browser requires verification with the Authenticator app, but trying to log in to the Authenticator app in order to verify our login in-browser in turn also requires approval through the Authenticator app. So we get stuck in a verification loop we can't get past to actually retrieve our licenses. We have secondary email addresses set up for password recovery, but those don't seem to be an option here.

When I contacted Microsoft, they would not help me and directed me to Techsoup for help instead (which was fine for getting the license we needed that one time, but not for fixing the overall issue). Nothing on this help page seems to be the right answer for us, either.

What can we do? As I said, I've already tried speaking with Microsoft directly and they would not help me (possibly because with all the turnover, we don't know whose names are even associated with our account).

Answer 1

You can recover your account credentials from your cloud account, but you must first make sure that the account you're recovering doesn't exist in the Microsoft Authenticator app. For example, if you're recovering your personal Microsoft account, you must make sure you don't have a personal Microsoft account already set up in the authenticator app. This check is important so we can be sure we're not overwriting or erasing an existing account by mistake. https://support.microsoft.com/en-us/account-billing/back-up-and-recover-account-credentials-in-the-authenticator-app-bb939936-7a8d-4e88-bc43-49bc1a700a40

For a microsoft work or school account you can manage (add / remove) devices here.

https://mysignins.microsoft.com/security-info

Without a backup to restore from the only option is to work with each of the service provider's account recovery methods. The authenticator app is nothing more than a code generator. The two factor is turned on or off at the service provider end.

-

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

I don't know what you mean by "service provider." Can you explain?

facebook, instagram, twitter, etc.

There are no recovery options for our org account

If you are the only global admin on the account and are blocked entirely, you can reach out to the Azure Data Protection team to restore access. 866-807-5850

Also, for the future, you can create an emergency access account (break glass) in Azure AD. This account will help prevent being accidentally locked out of your Azure Active Directory (Azure AD) organization because you can't sign in for any reason. https://docs.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access

Other support options include; AzureSupport https://support.microsoft.com/en-us/topic/global-customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2 azcommunity@microsoft.com

or creating a ticket through a different account: https://learn.microsoft.com/en-us/microsoft-365/admin/get-help-support?view=o365-worldwide#phone-support

-

--please don't forget to upvote and Accept as answer if the reply is helpful--