Personal Azure user: unable to log in to Azure after accidentally deleting the QR code.

Question

Symptoms: When I log into the Azure portal, two Authenticator verifications pop up.

The first one is for my Outlook email, which I can pass. The second one is for Azure Authenticator, but no verification prompt appears on my mobile device. I get stuck and cannot log into Azure. Previous action: Azure used to have a QR code in my mobile Authenticator app, and I could log in normally. After I accidentally deleted the QR code (the one for Azure login), the issue I described started happening. Request: I am the only global administrator for this Azure account (I use Azure as a personal user). I can no longer access Azure. How can I fix this?

Answer 1

The deleted Azure MFA registration (QR code) means the existing Azure passkey/Authenticator method for the Entra ID account is no longer valid, so sign-in is stuck at the second factor and cannot complete. Because there is only one global administrator and no alternative verification method, this is effectively a tenant lockout and cannot be fixed self-service.

The only supported resolution in this situation is to have Microsoft Support and the Data Protection (DP) team reset MFA for the affected admin account so that a new strong authentication method can be registered.

Action path:

1. Open a support case with Microsoft for the affected tenant (Azure / Entra ID) using any available channel that does not require signing in as that locked-out admin (for example, general support phone line or another Microsoft subscription sign-in if available).
2. Clearly state that:
   • This is a tenant lockout.
   • There is only one global administrator.
   • The only strong auth method (Authenticator QR/passkey) was deleted and no other methods are configured.
3. Ask for the case to be escalated to the Data Protection team to reset MFA for the global admin account.
4. Work with the DP engineer to complete identity verification (they will request business and identity details and may require back-and-forth verification).
5. After DP completes review, they will reset/re-register MFA for the admin account so that sign-in can succeed again and a new Authenticator/passkey can be configured.
6. Once access is restored, immediately:
   • Add at least one additional strong authentication method (for example, another Authenticator registration, SMS/voice, or security key) for the admin account.
   • Create a separate emergency access (break-glass) account with global admin rights and at least two independent auth methods, as described in “Manage emergency access accounts in Microsoft Entra ID,” so future lockouts can be avoided.

This pattern (tenant lockout with single global admin and no working MFA method) is handled only through Microsoft Support + Data Protection escalation; there is no portal or self-service recovery path once all admin MFA methods are unusable.

---

References:

• Troubleshoot sign-in issues and account access problems
• How Do I Regain Access to My Account After Losing Access to Microsoft Authenticator? (Urgent Request). - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• Azure has blocked myphone number for SMS verification due to a “bad reputation” flag - Microsoft Q&A