After changing my mobile phone, I cannot sign in to my work Microsoft account.

Question

When I enter my email and password, the system asks me to authenticate via the Microsoft Authenticator app; however, I cannot add my account there either, because the app itself prompts me to authenticate using Authenticator. An unexpected error occurs when I try to authenticate via SMS or a phone call.

Answer 1

Hello Vladimir,

Greetings! Thanks for raising this question in the Q&A forum.

This is a classic MFA lockout loop, it happens when Microsoft Authenticator was the only registered method, the phone changed, and now Entra ID requires MFA to sign in while also requiring MFA to re-register a new Authenticator instance, with SMS/voice failing as a fallback too. This cannot be resolved by the user alone from the sign-in screen, since self-service is exactly what's blocked here. The fix depends on whether you have access to another privileged account in the tenant.

1. If someone else in your organization has an eligible admin role Ask your IT administrator, or anyone with Global Administrator, Authentication Administrator, or Privileged Authentication Administrator role, to do the following on your behalf:

• Sign in to the Microsoft Entra admin center (entra.microsoft.com)
• Go to Identity, then Users, then select your account
• Open Authentication methods
• Select Require re-register multifactor authentication This clears your existing Authenticator registration server-side. On your next sign-in attempt, you'll be prompted to register MFA fresh, which lets you add Authenticator on your new phone without needing the old one.

1. Alternative that avoids a full reset: Temporary Access Pass Instead of clearing your MFA entirely, an admin with the same roles above can issue you a Temporary Access Pass (TAP) from your user's Authentication methods page. This generates a time-limited passcode you can use in place of MFA for a single sign-in, specifically to get back in and register your new Authenticator device yourself, without wiping any other configured methods.

New-MgUserAuthenticationTemporaryAccessPassMethod -UserId <your-user-id> -TemporaryAccessPassAuthenticationMethod @{isUsableOnce=$true}

(This can also be done entirely from the Entra admin center UI under the user's Authentication methods, no PowerShell required.)

1. If you have no admin access and no one else in your organization can help This becomes a tenant-level support case, not something that can be fixed from the sign-in page or resolved by community moderators, since only Microsoft's Data Protection / Tenant Recovery team can intervene from outside the tenant. To escalate:

• Go to Create a support request from any account you can still access, or contact Microsoft's global customer service phone line for business accounts
• State clearly that this is a work/school (Microsoft Entra ID) account lockout caused by loss of the only registered MFA method, and that both Authenticator re-registration and SMS/voice fallback are failing
• Be ready to verify your identity and tenant/organization details, since this is what the Data Protection team requires before resetting anything

Why SMS/voice is also failing If SMS or phone call was never actually registered as a working fallback method (only configured but never verified, or tied to a number no longer active), it will fail silently at this stage rather than working as a backup. This is worth confirming with whoever resets your MFA, so a working secondary method gets registered alongside the new Authenticator app this time.

Once you're back in, prevent this from recurring Register at least two authentication methods (for example Authenticator plus a phone number that's actually current), so a single device change doesn't cause a full lockout again.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix.