A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation
The Xbox app is asking for a USB security key because the Microsoft account is configured to use a strong sign-in method (security key / passkey / passwordless). To get unstuck, remove or reset the problematic sign-in method and add an alternative one that works, then sign in again.
Use these steps in order:
- Set up an alternative sign-in method
- Go to the Advanced security options page of the Microsoft account and sign in if possible.
- Select Add a new way to sign in or verify and choose another method (for example, SMS or email verification).
- A security code will be sent to the new phone number or email. Enter that code to confirm, then select Next.
- Remove the method that is blocking sign-in
- Still on Advanced security options, find the security info / verification option that is causing the issue (for example, a security key or passkey that is no longer available).
- Select it and choose Remove, then confirm.
- Important: Do not remove all security info at the same time, or the account may be restricted for 30 days.
- If all security info is lost
- If none of the existing security methods can be used (no access to any phone/email/security key), start sign-in to the Microsoft account.
- At the Verify your identity prompt, select I don't have any of these.
- Follow the instructions to replace the security info. After replacement, there is a 30‑day wait before normal sign-in is allowed. If the old security info becomes available during that period, using it will cancel the pending change.
- If verification codes are not arriving
- Ensure the verification email is being sent to the correct mailbox (primary alias or an email added as a way to verify sign-in) and check the junk folder for messages from @accountprotection.microsoft.com.
- Avoid making many repeated code requests; excessive or repetitive requests can cause temporary blocking of code delivery.
- If using SMS, confirm the phone can receive texts from unknown numbers and is not a VOIP number.
- If blocked due to unusual activity or high volume of requests, wait at least 24 hours (up to several days) before trying again.
- Consider using a different passwordless method instead of a USB key
- For future sign-ins, configure a passwordless method such as Microsoft Authenticator, SMS/email codes, or Windows Hello, so the Xbox app can use those instead of a physical USB key.
Once an alternative sign-in method is added and the problematic key/passkey is removed, sign out of the Xbox app on the PC (if partially signed in), then sign in again using the updated method.
References: