Unable to access Azure console

Question

I have a website hosted on Azure Web Apps. When I try to log in with my personal account, which is the one linked to my payment card, it prompts me for two-factor authentication, but I never receive the code in the "Authentication" application. My SSL certificate is expired, so my site appears as insecure, but I can't access the Azure console to fix this problem. I can't contact Azure support because every time I try to report the issue, it requires me to be logged in, so I'm stuck in a loop that I haven't been able to break for a month!

Answer 1

Follow these two parallel tracks: fix portal access (MFA loop) and then renew/bind the certificate once access is restored.

1. Break the MFA / sign‑in loop to Azure

Because the account uses Azure Multi‑Factor Authentication and the code is never accepted/received, treat this as an MFA/sign‑in problem first.

1. Try different browser/session and clear cached data
   • Sign out of all Microsoft accounts in the browser.
   • Clear all site data/cache for Microsoft/Azure sites.
   • Open an InPrivate/Incognito window and try signing in again to the Azure portal.
   • This pattern has resolved similar “can’t access Azure” and verification loop issues for other users.
2. Verify the MFA prompt/code entry
   • If using the Authenticator app with code entry, ensure the correct verification code is typed and submitted promptly; entering the wrong code or cancelling the prompt causes the sign‑in to fail with messages like “We did not receive the expected response. Please try again.”
   • If using push notifications, make sure Verify is tapped, not Cancel, on the MFA prompt.
   • If the sign‑in screen offers it, select Other verification options and choose another method (SMS, alternate phone, etc.).
3. If the account is in an Entra (Azure AD) tenant where an admin exists
   • An administrator can reset the MFA registration for the affected user:
     1. Sign in to the Microsoft Entra admin center with a Global Administrator account.
     2. Go to Identity > Users > All users.
     3. Select the affected user.
     4. Open Authentication methods.
     5. Select Require re‑register MFA.
   • After this, sign‑in will prompt to set up MFA again, which should break the stuck profile.
4. If this is a personal account with no other admin
   • Use a different Microsoft account to contact Microsoft Support (for example, a newly created account) and explain that MFA on the primary subscription owner account is stuck and needs to be reset. The Q&A guidance indicates that direct account/MFA reset requires working with support when self‑service options fail.

2. Renew and re‑bind the SSL certificate once portal access works

After portal access is restored, address the expired certificate on the Azure Web App.

1. Renew or recreate the certificate
   • If the App Service certificate is expired, create a new certificate or renew the existing one.
   • Ensure Auto Renew is set to On for long‑term prevention.
   • If renewal is pending because of domain verification, complete domain ownership verification and then resume/re‑initiate the renewal.
2. Sync the renewed certificate to the Web App
   • After renewal, sync the certificate to the web app so it starts serving the new certificate immediately. Use the portal Sync action or az webapp config ssl bind if using CLI.
3. If the app still shows the old/expired certificate
   • Check the Key Vault used by the App Service certificate:
     1. In the Azure portal, open the Key Vault.
     2. Go to Access policies.
     3. Ensure the following service principals exist with at least the listed permissions:
        • Microsoft Azure App Service – Secret: Get; Certificate: Get
        • Microsoft.Azure.CertificateRegistration – Secret: Get, List, Delete; Certificate: Get, List
     4. Save changes and run Sync again on the certificate.
4. Last‑resort workaround if automatic sync still fails
   • If the certificate is valid and present in Key Vault but the app cannot pick it up:
     1. In Key Vault, locate the secret for the certificate and download the PFX.
     2. In the Web App’s TLS/SSL settings, use Upload Certificate and upload the PFX (password is typically blank for Azure‑downloaded PFX).
     3. Create/bind an SSL binding for the custom domain to this uploaded certificate.
   • This bypasses automatic sync, so it is recommended only as a last resort; fixing Key Vault access is preferred.
5. Confirm HTTPS works
   • Browse to the site over HTTPS and verify that the browser no longer reports the certificate as expired or insecure.

---

References:

• Troubleshoot Azure App Service certificates
• Troubleshoot domain and TLS/SSL certificate problems in Azure App Service
• "We did not receive the expected response" error message when you try to sign in by using Azure Multi-Factor Authentication
• Reset Personal Azure MFA - Microsoft Q&A
• Can not access Azure - Microsoft Q&A
• Stuck in Verification loop while trying to make cart purchase - Microsoft Q&A