A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation
The 8‑digit codes in Microsoft Authenticator are for one type of MFA configuration, while the Azure sign‑in page currently expects a 6‑digit code. This mismatch usually means the Azure MFA profile for the account is stuck or misconfigured, and self‑service options (email/SMS) are not being offered.
Because only the Authenticator option is shown and it does not match the prompt, the MFA registration must be reset from the directory side:
- Sign in with another account that has Global Administrator rights in the same tenant (for example, a colleague’s admin account or a break‑glass admin account) to the Microsoft Entra admin center.
- Go to Identity → Users → All users.
- Select the affected user account.
- Open Authentication methods.
- At the top, select Require re‑register multifactor authentication.
- Sign out, then sign back in as the affected user. The sign‑in flow should now prompt to set up MFA again and allow registering a method that matches what Azure expects (for example, push notifications or a compatible code format).
If there is no other Global Administrator in the tenant (only one admin and that account is locked by MFA), this must be escalated to Microsoft Support (Data Protection / Tenant Recovery) so they can verify tenant ownership and reset MFA from the backend. This is the same pattern used in similar lockout cases where the only registered method (Authenticator) no longer works and no alternative verification options are available.
If SMS or email verification is later used and codes do not arrive, use the guidance in the verification‑code troubleshooting articles, including trying another verification method, another network, and the sign‑in helper tool.
References: