Authenticator App Problem

Question

You cannot set up Microsoft Authenticator because you already have five authenticator apps or hardware tokens. Please contact your administrator to delete one of the authenticator apps or hardware tokens

I am the only account admin. this is a deadlock. how to fix?

Answer 1

The error occurs because the account already has five authenticator apps or hardware tokens registered, which is the maximum allowed. Since the account is also the only admin, use one of the following approaches to break the deadlock.

1. Try deleting sign-in methods in a browser

If sign-in is still possible (for example, via another MFA method like SMS or phone call):

1. Go to https://aka.ms/mysecurityinfo.
2. Review the list of sign-in methods (phone, authenticator app, etc.).
3. Delete one or more authenticator app methods so that fewer than five remain.
4. After that, add Microsoft Authenticator again on the new device.

If a passwordless sign-in method is configured and cannot be deleted, first set up another two-factor method (such as SMS or phone call), then use that method to sign in and delete the passwordless authenticator entry.

If there is another admin in the tenant, that admin should in Azure portal:

1. Open Microsoft Entra ID → Users → select the user → Authentication methods.
2. Select Require re-register multifactor authentication.
3. Then the user can reconfigure MFA and remove old methods via https://aka.ms/mysecurityinfo.
4. Use Microsoft Graph as Global Administrator

If sign-in as a Global Administrator is possible, the authenticator methods can be deleted via Microsoft Graph:

1. Sign in to Graph Explorer as a Global Administrator.
2. Run a GET request: https://graph.microsoft.com/beta/users/<user-principal-name>/authentication/microsoftAuthenticatorMethods
3. From the response, copy the id (GUID) of each authenticator method to remove.
4. For each id, run a DELETE request: https://graph.microsoft.com/beta/users/<user-principal-name>/authentication/microsoftAuthenticatorMethods/<authenticator-id-guid>
5. After deleting enough methods, set up Microsoft Authenticator again.
6. If completely locked out as sole admin

If no MFA method works and sign-in is impossible, and there is no other admin who can reset MFA, the tenant is in a lockout state. In this case, contact Microsoft support and request the Data Protection team to reset the admin’s MFA methods. This is the only way to regain access when the sole Global Administrator is locked out and cannot complete MFA.

---

References:

• Can't set up MFA because five devices are already registered to use an authenticator app
• How to add your accounts to Microsoft Authenticator
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• I cant log in to my business account because it is requiring Authenticator app which I do not have - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A
• Troubleshoot problems with Microsoft Authenticator
• Common problems with two-step verification for a work or school account
• Authenticator Did Not Complete Login
• Microsoft Curate - Troubleshoot Multi-Factor Authentication (MFA)
• Install and use the Microsoft Authenticator app
• Single Credential Login and Multi-Factor Authentication FAQ