not able to access work account- [Moderator note: personal info removed]

Question

Dear Support Team,

We are currently unable to log in to our account as it displays the following message:

"Access denied. Approve the sign-in request on the Authenticator app."

However, no Authenticator app has ever been installed or configured for this account.

As an alternative, we selected the option to receive a verification code via SMS. Unfortunately, the mobile number registered with the account did not receive any text message or verification code.

Please note that this is a generic/shared account used by multiple team members for our HR operations. Due to this issue, our team's work has come to a complete halt.

We request your immediate assistance in:

• Restoring access to the account.
• Investigating why the registered mobile number is not receiving verification codes.
• Explaining the reason for this authentication issue and the sudden loss of access, as this account was functioning normally earlier.

This issue is impacting our daily HR operations, so we would appreciate your urgent support in resolving it at the earliest.

Thank you, and we look forward to your prompt response.

Answer 1

Hi @Sanjay Singh

Regarding your issue, the account is being blocked because Microsoft is requesting MFA verification, but the available authentication methods are not working or may be outdated. This can happen after a security policy change or an MFA update. Please contact your IT administrator to reset the account’s MFA settings in Microsoft Entra ID and verify the registered phone number. After the reset, you can sign in and configure MFA again.

They can follow these steps:   

1. Sign in to the entra.microsoft.com as at least Authentication Administrator.   
2. Select User -> All user.   Select the user (your account) to act on and select Authentication methods. then select Require re-register of multi-factor authentication.    

• Require re-register MFA: This disables all previous authentication methods. You'll then be prompted to configure a new MFA authentication method the next time you try to sign in, so you can set up from the start and add a new authenticator app.   

For more details, please refer to: Manage user authentication methods for Microsoft Entra multifactor authentication. 

Note: Once re-registration is triggered, all your existing MFA methods such as phone numbers, Authenticator app, or other verification options will be removed. You will need to set up new MFA methods during your next login. Please ensure you have access to a valid phone number or the Microsoft Authenticator app before attempting to sign in again. 

If you’re the only Global Administrator and are locked out, please contact the Microsoft Data Protection team, as they are the only team that can assist with this issue. As a fellow forum user, I can only offer general guidance and basic troubleshooting. I don’t have access to account recovery tools, and users in this forum cannot verify your identity or restore your administrator account. The Microsoft Data Protection team has the appropriate tools and processes to verify account ownership and assist with restoring access. Please contact them directly for further assistance.

You can find the appropriate customer service phone numbers at this link: Customer service phone numbers.

(Choose Work account scroll down to Technical support phone numbers and find the Phone number of your country)

Please remember to provide them with your account details and explain the situation. Be ready to provide:     

• The company name used during subscription    
• Billing email address (even if it’s a personal Microsoft account)    
• Payment method details (last 4 digits of the card, billing address)    
• Any subscription ID or invoice numbers from billing email    

When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.

To make the process smoother, here’s an example of how to respond when speaking to the automated system (IVR):     

IVR: What kind of problem are you concerned about?     

You:  Authenticator.    

IVR: What kind of product do you use?     

You: Office 365 for business.     

IVR: education or company account?     

You: For companies     

IVR: Are you an administrator?     

You: Yes.     

IVR: Do you have the other administrator in your organization?     

You: No.     

IVR: Do you need a... Service request?     

You: Yes     

These prompts help direct your call to the right support team more quickly, especially when dealing with account lockouts and authentication issues.

I hope this information is useful. Please note that further assistance with account recovery will need to come directly from the appropriate Microsoft support team.

---

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

First and foremost, Microsoft365 is licensed by named user.

Using a single login, to be shared by an entire team has a few issues

1. It creates a license mis-use scenario as M365 is licensed by named users
2. It creates a situation where you lose accountability, you do not know who did what (eg deleted something) as it can be accessed by an entire department
3. It creates issues with Multi-Factor authentication, where you need a second confirmation (eg authenticator app) to login. In this case, you probably assume that MFA was not setup but as a group, it is possible that someone did link his phone to that account, and something happened to that phone (upgraded, reset, reinstalled authenticator etc).

The way forward is

1. Get the administrator to reset this account, and reconnect the authenticator on the specific phone.
2. Better yet, license every user and have each user setup their own authenticator on their phone.

Regards