A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation
Two-step verification (2FA) cannot be removed or reset through this channel. Recovery depends on what kind of account and access options are still available.
Use the path that matches the situation:
- If this is a work or school (Microsoft 365/Entra ID) account and there is another admin
- Contact the organization’s Microsoft 365/Entra administrator.
- The admin should:
- Go to Microsoft Entra ID in the Azure portal → Users → select the user.
- Open Authentication methods.
- Select Require re-register multifactor authentication so that MFA is reset and can be set up again on the new phone.
- If this is a work or school account and there is no other admin (you are the only global admin)
- This must be handled by Microsoft Support’s Data Protection team.
- Call Microsoft using the country-specific number from Customer service phone numbers - Microsoft Support (from the context articles).
- When the automated system asks, clearly indicate:
- Issue: “Authenticator”
- Product: “Office 365 for business”
- Account type: “Company account”
- Confirm that you are the administrator and that there are no other admins.
- Ask to open a service request and escalate to the Data Protection team to reset MFA on the admin account.
- If support access is blocked because you cannot sign in, one documented workaround is to create a temporary trial tenant, go to the new tenant’s admin center, and open a support ticket from there, explaining that you are locked out of a different tenant and need Data Protection to reset MFA on that original tenant.
- If this is a personal Microsoft account and you still have another sign-in method (SMS, email, passkey)
- Use the alternative method (SMS, email code, or passkey) when prompted instead of the Authenticator app.
- After signing in, go to your account security settings (from the context:
https://account.microsoft.com/security) and remove or update the old Authenticator sign-in method, then add the new phone using Microsoft Authenticator.
- If this is a personal Microsoft account and no other method works
- Use the account recovery and alternative verification options presented on the sign-in screen (for example, “I don’t have any of those”).
- If recovery succeeds and you can sign in, immediately:
- Remove the old Authenticator app method.
- Add the new Authenticator app on the new phone.
- If you are stuck in an MFA loop as the only admin on a business tenant
- As shown in the referenced Q&A cases, only Microsoft’s Data Protection team can clear or reset MFA when the sole global admin is locked out and no alternative method works. This cannot be done from forums or by other users.
Until MFA is reset or an alternative method is used, access to the account cannot be granted and 2FA cannot be removed.
References:
- Microsoft Authenticator FAQs
- Use a screen reader to set up and troubleshoot multifactor authentication
- Can't set up MFA because five devices are already registered to use an authenticator app
- Common problems with two-step verification for a work or school account
- Troubleshoot signing in with a passkey
- How Do I Regain Access to My Account After Losing Access to Microsoft Authenticator? (Urgent Request). - Microsoft Q&A
- Cannot authenticate with E-mail when logging into Microsoft Authenticator(iOS). - Microsoft Q&A
- I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
- Microsoft authenticator sending me into a spiral - Microsoft Q&A
- Requesting a Tenant Admin MFA Reset - Microsoft Q&A