Updating Security Info

Question

I am unable to update our security info on the charity account I am administrators for. When I go to update it asks me to setup two step verification, I get a message telling me a code has been sent to a number our office bearers do not recognise.

I have gone to https://aka.ms/mfasetup, to check security info, but I get message advising of a text to the number we do not recognise. I am going round in circles trying to resolve this issue.

Can anyone help/advise how I can update security info.

Answer 1

To update the security info when the verification code is going to an unrecognized phone number, follow the supported recovery paths for a work/school (charity/tenant) account:

1. First confirm the sign-in account details
   • Make sure the correct account and domain are being used (for example, the right charity tenant and correct email spelling). If the phone/email shown for verification is still not recognized, treat it as untrusted security info.
2. If at least one admin or user can still pass MFA
   • Any Global Admin (or appropriate admin) who can sign in and pass MFA can reset another user’s MFA and security methods from the Microsoft Entra admin center by using “Require re-register multifactor authentication” for that account. This forces the affected account to set up MFA and security info again at next sign-in.
   • This is the standard way to break the “going in circles” problem when an old or unknown method is still configured.
3. If the admin account has lost access to some, but not all, security info
   • Sign in to the Advanced security options page with the work/school account (any method that still works).
   • Select Add a new way to sign in or verify and add a new phone, email, or method.
   • After verifying the new method, expand the unrecognized phone/email entry and select Remove.
   • Do not remove all existing security info at once, or the account can be restricted for 30 days.
4. If the admin account has lost access to all security info
   • Start sign-in to the work/school account.
   • At the Verify your identity prompt, select I don't have any of these.
   • Follow the prompts to replace the security info. Once replaced, there is a mandatory 30‑day wait before normal sign-in with the new info is allowed. During this period, if any old method becomes available again and is used, the pending change is cancelled.
5. If the password is also not known or cannot be reset with existing methods
   • Use the documented account recovery process for work/school accounts as described in the guidance on recovering an account when both password and security info are unavailable.
6. If no one in the tenant can get past MFA
   • For a business/charity tenant where all admins are locked out by MFA and no alternative methods exist, the only supported route is to contact Microsoft support (or the licensing partner) so the data protection team can assist with admin/MFA recovery for the tenant.
7. Important security notes
   • If the unrecognized phone number was added by someone else, treat the account as potentially compromised. After regaining control, remove any unknown phone/email entries and add trusted methods only.
   • Avoid changing or removing all security info at once to prevent the 30‑day restriction window unless absolutely necessary.

These are the supported ways to break the loop where MFA and security info updates always send codes to an unrecognized number and to re-establish trusted verification methods on the charity’s tenant account.

---

References:

• Common problems with two-step verification for a work or school account
• Troubleshoot Microsoft verification code issues
• Use a screen reader to set up and troubleshoot multifactor authentication
• I need to reset my mfa methods - Microsoft Q&A
• My account got hacked. - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A
• Please confirm my e mail address as <removed PII>@outlook.com - Microsoft Q&A

Answer 2

Good day @Bobby SDSNSL, and I’m sorry to hear about the difficulties you’re experiencing.  

Because administrator accounts have elevated permissions, Microsoft Entra ID requires them to use multi‑factor authentication (MFA) to maintain a higher level of security. In new tenants, MFA for administrators is enforced automatically through Security Defaults. This protection is enabled by Microsoft by design to reduce the risk of account compromise and is now a standard requirement for administrative access. 

With that in mind, please follow the steps below to regain access: 

1/ Contact other IT admins 

Please check whether there are other IT administrators in your company who can sign in to Microsoft Entra ID and assist you with resetting the MFA settings for your account. You can share with them the steps outlined in the article Manage user authentication methods for Microsoft Entra multifactor authentication. This will help them assist you in resetting your MFA settings and restoring access to your account. 

Once your IT admin has reset your MFA, the next time you log in to your account, you will be guided through the process of setting up your authentication methods again, such as SMS, email, or the Microsoft Authenticator app. This will break the loop and allow you to access your account normally.  

2/ If your admin account can access the Microsoft 365 admin center without MFA verification

If your admin account can access the Microsoft 365 admin center without being prompted for MFA, you can create a new user and assign the Global Administrator role without needing a license.

Navigate to Users > Active users > Create a new user > Assign the Global Administrator role.

Then, you can follow the steps in the article above to reset your admin MFA.

However, if MFA is required when signing in to the Microsoft 365 admin center, you will need to review the alternative options outlined below.

3/ Contact Microsoft Data Protection Support by phone 

If you're the only admin, in this situation, the Microsoft Data Protection Team has tools and processes in place to verify identity and regain access to administrator accounts. You can try reaching out to our Global Customer Service phone to raise a request for resetting your authentication method here: Customer service phone numbers - Microsoft Support. 

Here are some tips and an example of a prompt to help you navigate the IVR more effectively:      

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)    

IVR: What kind of problem are you concerned about?    

You: Authenticator.    

A: What products do you use?    

You: Office 365 for business. 

Verification: Education or company account?    

You: For companies 

IVR: Are you an administrator?     

You: Yes. 

IVR: Are there any other administrators in your organization?     

You: No. 

IVR: Do you need a... Service request?     

You: Yes. I need to create a ticket. Please send me directly to the Data Protection Team. 

4/ Create a new tenant to submit a support ticket 

If you cannot reach a live agent, there is still a workaround, you might consider registering for a new tenant by signing up for a trial subscription. 

To set up a new tenant, please follow these steps: 

Visit Microsoft 365 Business Plans and Pricing | Microsoft 365. This would allow you to create a new tenant following the prompts provided. Once set up, you can access the admin console of the new tenant and submit a support ticket requesting to speak with the Data Protection team on behalf of your previous tenant. 

Follow the guided setup process to create a new account for a new tenant. 

Once your tenant is created, you should be able to access the support portal and submit your ticket referencing your locked account without further issues. 

In your ticket description, you'll need to clearly explain that you're trying to regain access to your previous Microsoft 365 tenant and need help from the Data Protection team. Here's a message you can use or adapt: 

"Hello, I’m currently unable to access my previous Microsoft 365 tenant due to losing MFA access, which prevents me from receiving verification codes. I’m the global admin, but I’m locked out and unable to generate a QR code or bypass MFA. 

I created this new tenant solely to request assistance. I kindly ask to be connected with the Data Protection team to verify my identity and help me recover access to the original tenant. 

This is urgent, as I rely on Microsoft 365 for my work and have been unable to operate for several days. I’m available to provide any documentation or verification needed to support the recovery process." 

• Ticket Support: In the Microsoft 365 Admin Center > Support > Help & Support. 
• Please remember to cancel the trial subscription after your issue is resolved, as this will help you avoid any accidental billing. You may prefer the following resource for detailed instructions: Cancel your Microsoft business subscription in the Microsoft 365 admin center | Microsoft Learn 

I hope this helps you regain access to your account quickly. I'm glad to assist and truly hope the information provided has been useful. Please feel free to reach out anytime if you need further assistance. 

Thank you for your patience and understanding.  

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have any extra questions about this answer, please click "Comment".            

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

Answer 3

If the account is asking for a verification code to be sent to a phone number that none of the current office bearers recognize, it is likely that the account's security information was configured by a previous administrator or account holder.

To regain access, check whether any former administrators may have registered that phone number. If no one has access to the number, you will need to initiate the account recovery process or contact Microsoft Support for assistance.

If this is a Microsoft 365 charity or organizational account, another Global Administrator in the organization may be able to reset the authentication methods for the account through the Microsoft 365 admin center. If no administrator has access, contact Microsoft Support and be prepared to provide proof of ownership and administration of the organization.

Unfortunately, security information cannot be changed without completing the required verification process unless it is reset by an authorized administrator or Microsoft Support.