A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation
Because passkey is the only sign-in method and is failing, and there are no working SMS or Authenticator options, the only supported paths are to update or recover the account’s security info and then wait out any enforced restriction period.
Follow these steps based on the available options:
- If the password is known and at least one security method still works
- Go to the Advanced security options page of the Microsoft account and sign in.
- Select Add a new way to sign in or verify and add a new phone number or email for security codes.
- After confirming the new method with a code, expand the old/failed verification option (such as the passkey-only method) and select Remove.
- Do not remove all security methods at once, or the account may be restricted for 30 days.
- Sign in to the Advanced security options page of your Microsoft account.
- Select Add a new way to sign in or verify then choose how to receive security codes.
- Confirm the new method with the code sent.
- Remove the old security info that is no longer accessible.
- If the password is known but all security info is effectively unusable (no SMS/Auth working)
- Begin sign-in to the Microsoft account.
- At the Verify your identity prompt, select I don't have any of these.
- Follow the instructions to replace the security info.
- After replacement, access to the account is restricted for 30 days before normal sign-in is allowed. During this period, existing security info can still be used if it becomes available again, but doing so cancels the update.
- If the password is not recognized or cannot be used
- First try to regain access to any missing security info (phone, email) if possible.
- If that is not possible, use the Microsoft account recovery form:
- Review the guidance in Help with the Microsoft account recovery form.
- Complete the Account recovery form from a device and location previously used to sign in (home or office).
- If two-step verification was enabled and none of the alternate verification methods are accessible, support agents cannot override this or reset the security info; recovery depends entirely on successful self-service verification.
- If the account is locked or rate-limited due to too many attempts
- Microsoft may temporarily lock accounts after too many failed sign-ins or recovery attempts.
- If password resets, verification codes, or recovery forms have hit limits, wait for the lockout period (commonly about 24 hours) before trying again, and avoid repeated attempts during that time to prevent restarting the cooldown.
- When retrying, use a familiar device and network and ensure all details in the recovery form are accurate and complete.
- If access to all methods is blocked and recovery keeps failing
- For personal Microsoft accounts, account recovery is fully automated for security reasons; moderators or support agents cannot manually unlock or bypass security info.
- The only option is to:
- Wait out any lockout period.
- Retry sign-in and security info replacement using I don't have any of these.
- Or submit the account recovery form again once the daily limit resets, providing as much accurate historical information as possible.
These are the only supported mechanisms to restore access when passkey is the sole sign-in method and no other verification options are available.
References:
- Microsoft account has been locked
- Troubleshoot Microsoft verification code issues
- Help with the Microsoft account recovery form
- Locked out of my Outlook account and recovery options not working - Microsoft Q&A
- My Microsoft account is blocked. - Microsoft Q&A
- I need to speak with a real person and it seems impossible. - Microsoft Q&A