My Account is blocked

Question

Hello,

To give a little backstory: my laptop blue-screened recently. It's not the first time this has happened, and there is BitLocker setup on that drive, so my process in the past to recover it has been to login to my Microsoft account on my phone, get the BitLocker key, then I'm able to restore windows to a previous date.

I have had 2-factor authentication setup on my Microsoft account, too (using my phone number and Microsoft Authenticator App). I have also got a new phone recently (same phone number) and didn't setup authenticator on that phone yet.

When I tried to login to my account to get the bitlocker key, I kept using the wrong password. So the account eventually got blocked for too many incorrect password attempts.

On one of the help articles it said I could reset my password. I attempted to do that and was able to get a code to my email (a Gmail account), but the problem is that it wanted me to approve a separate code on my authenticator app (which I don't have access to anymore) and the other option was a phone number, so I entered the last 4 digits of my phone number, but never got a code (so maybe that isn't setup on my account?).

THEN, in my panic of trying to login to be able to get the key to restore my laptop, I must have somehow updated my security info? Because when I tried to login again using what I think might have been the correct password, I got a page that said this:

Your security info change is still pending On 2/24/2026 you requested that your security info be replaced.

Current security info Alternate email: XX*****@gmail.com Phone number ending in XX An app New security info Alternate email: XX*****@gmail.com Your security info will be replaced after 30 days, on 3/26/2026. Until then, you won't be able to sign in to your account unless you can use your current security info or a trusted device. If you didn't request this, let us know. If you'd like to keep your current security info, you can cancel this request.

XX is to hide my data. But you can see that it did list the correct last 2 digits of my phone number, so why didn't it send me a code?

I can't login on a trusted device because both my laptop and old phone are unavailable. And I can't cancel the request because that again makes me login using authenticator (which I don't have access to the phone that had it setup)

I tried looking for a contact phone number or an email or chat or something with Microsoft, but there's nothing out there. So am I just SOL until 30 days from using my account and being able to recover my laptop? Any help would be so so appreciated.

Answer 1

The account is in a 30‑day security‑info change lock, combined with MFA (Authenticator + phone) that is no longer accessible. In this state, options are limited and are controlled entirely by Microsoft’s automated security system.

Key points from the scenario and what they mean:

1. Security info change pending for 30 days
   The message:

   Your security info change is still pending… Your security info will be replaced after 30 days… Until then, you won't be able to sign in to your account unless you can use your current security info or a trusted device.

   This is the standard 30‑day protection period after a security info change. During this period:
   • The account is effectively locked behind the existing security info (old Authenticator, old phone, etc.).
   • New security info (like the updated alternate email) cannot yet be used to fully sign in.
   • If there is no access to any current security method or trusted device, access is blocked until the 30 days elapse.
2. Why the phone code did not arrive
   From the verification‑code guidance:
   • Accounts can be blocked from sending codes due to unusual activity, high volume of requests, or suspicious patterns.
   • There can also be regional SMS issues, message‑app problems, or number‑type issues (VOIP not supported).
   Specifically:
   • Microsoft may temporarily stop sending SMS codes if there are many repeated attempts or unusual activity on the account.
   • Even if the last digits shown are correct, the system can still block delivery during a security lock or if it has flagged the number or region.
3. Account block due to unusual/incorrect sign‑ins
   The behavior described (multiple wrong passwords, then blocks and “try another verification method” / no code) matches:
   • Temporary blocks for unusual activity or high volume of requests.
   • These blocks can prevent codes from being sent and may only clear after some time.
4. What can be done now Within the 30‑day security‑info change window, recovery options are limited to what is already configured and accessible:
   • Try another verification method if any is still usable:
     • If the account offers multiple methods (SMS, alternate email, app), use the one that still works.
       – For example, if email codes are still delivered successfully, follow the on‑screen flow and see if that path allows sign‑in or cancellation of the pending change.
   • Try another network / device:
     • Use a different browser, InPrivate/Incognito mode, or a different network (e.g., mobile data instead of Wi‑Fi) when attempting sign‑in or password reset, as recommended in similar blocked‑code cases.
   • Wait out the block:
     • For verification‑code and unusual‑activity blocks, guidance is to stop repeated attempts and wait at least 24 hours, and up to several days, before trying again. Repeated attempts can reset the timer.
   However, for the 30‑day security‑info change hold, if there is no access to:
   • The old Authenticator app,
   • The old phone (for SMS/voice), and
   • Any trusted device already marked for that account,
   then the system will not allow bypassing the hold. After the 30 days, the new security info becomes active and sign‑in should be possible using that new info.
5. BitLocker key impact Because the BitLocker recovery key is stored under the Microsoft account, and the account is locked behind MFA and the 30‑day hold, the BitLocker key cannot be retrieved until the account can be accessed again. There is no supported way for support agents to override MFA or the 30‑day security‑info protection; documentation states that support agents cannot send verification codes or change account details outside the official flows.
6. Realistic expectation Given:
   • No access to the old Authenticator,
   • No access to the old phone / trusted device, and
   • A 30‑day security‑info change in progress,
   the practical outcome is:
   • The account will remain inaccessible until the 30‑day period ends and the new security info becomes active.
   • At that point, sign‑in should be possible using the updated security info, and the BitLocker key can then be retrieved—assuming the device and drive are still intact.
   There is no documented supported method to shorten or bypass this 30‑day window when all current security methods and trusted devices are unavailable.

---

References:

• Troubleshoot Microsoft verification code issues
• Common problems with two-step verification for a work or school account
• What happens if there's an unusual sign-in to your account
• Microsoft account has been locked
• Unblock my Outlook.com account
• My Microsoft account is blocked. - Microsoft Q&A
• I need to speak with a real person and it seems impossible. - Microsoft Q&A