User is prevented from accessing Azure Portal by an unexpected MFA prompt

Question

Our company has 2 Azure Subscriptions.

Subscription 1 is our original one where we manage Entra users as well as some Azure services.

Subscription 2 contains additional Azure services.

Normally we can sign in and switch subscriptions to manage the resources.

One of the admin users got a new mobile phone. Previously they were able to use MS Authenticator to sign in to Azure Portal and manage both subscriptions.

After changing to the new phone and setting up MFA, the supplied codes do not work.

We then removed all MFA Authentication methods apart from Phone and SMS.

We then discovered that this only seemed to apply to subscription 1, i.e. accessing subscription 2 was still requiring an authenticator code.

Is there a way to revert to having the MFA setup apply to both subscriptions as it seemed to previously?

Answer 1

Hello @Conor McCarthy

If there is another Global Administrator in Subscription 2, they can re-register MFA for the affected user by following these steps:

1.Go to Microsoft Entra ID https://portal.azure.com/#home in Subscription 2.

2.Select Users and choose the specific user.

3.Click on Authentication methods.

4.Select Revoke multifactor authentication sessions.

5.Then click Require re-register multifactor authentication.
Hope this helps. Do let us know if you have any further queries

If this answers your query, do click `Accept Answer` and `Yes`