How can an M365 Admin remove redundant MFA devices used by users of the tenant

Question

I am sure this has been asked many times before.

An employee has replaced the phone that MFA was registered to use. The phone NO LONGER EXISTS but when we log into M365 it wants the old device to authenticate.

I am their M365 admin - how do I manage the old device without having it?

Answer 1

Hi @Shane King . Thank you for reaching out to us.

As I understand that one of the user have lost their phone and want to know more on managing device/accessing M365 resources.

Adding to the above information provided by @Yuki Sun-MSFT

Right that the MFA verification will go to user's previous device, which no longer have access to. However, there are some ways to access M365 account on a new phone without user's old device, such as:

 Use a Temporary Access Pass create temporary Access Pass for that user ask them to login with Temporary Access Pass. A Temporary Access Pass is a time-limited passcode that user can use to sign in to your M365 account without old device. Once user logged in to portal. He himself can register for a new device and can delete the old device as well.

Also, if user has backup of authenticate app settings refer to this link on how to restore it - https://support.microsoft.com/en-gb/account-billing/back-up-and-recover-account-credentials-in-the-authenticator-app-bb939936-7a8d-4e88-bc43-49bc1a700a40

let me know if you have any further questions, feel free to post back.

Thank you,

Navya.