mfa fails for some accounts on yubikey

Question

mfa fails for some accounts on yubikey

bmc 0

I'm setting on mfa for my users using a single yubikey that only I have access to (can't trust end users). I KNOW the key was setup properly because I used the 6 digit code to setup desktop office/outlook and mobile devices last week. But today, the code fails when I went to access some of the accounts for admin reasons. My older accounts that were added two weeks ago are fine... seems to be limited to ones added last week.

0 comments

2 answers

Your answer

Answer 1

bmc 0

Just the standard error about a bad key.

As I said originally, the keys worked when I added them to the yubikey as I used them to setup office desktop, outlook, and ios devices.

All codes were setup by 1) enabling mfa for the user 2) logging in as the user and completing mfa enrollment.

Logs show 500121 mfa failure codes.

Elena-VH 2,130 Reputation points Independent Advisor

2026-09-02T16:39:34.1166667+00:00

Dear bmc,

Since this is affecting multiple users and you're seeing error 500121, while older accounts continue to work with the same YubiKey, this may indicate an issue with the Hardware OATH registration.

First, I'd recommend checking whether the OATH secret stored in Entra still matches the secret currently stored on the YubiKey for the affected accounts. A mismatch can occur if the token was re-imported, reassigned, or overwritten after the initial enrollment.

As a test, you could try removing the existing Hardware OATH token assignment for the user and re-register/reassign the Hardware OATH token. Then, test the MFA prompt again using the newly generated code from the YubiKey.

Note: Make sure that there have been no recent MFA method resets for the affected users.

If the newly registered token also fails with an error, and since this is affecting many user accounts, I recommend contacting Microsoft Technical Support in the M365 Admin Center for further troubleshooting, as additional investigation into the tenant configuration, authentication method registration, and backend sign-in logs may be required. For reference: Get support for Microsoft 365 for business

Note: As a forum member like you, please understand that my resources are limited, and I do not have access to your environment or the necessary backend diagnostic tools to investigate this further.
bmc 0 Reputation points

2026-09-02T17:12:39.64+00:00

google gemini found the cause and a solution that did not require wiping/reenrolling devices. thanks.
Elena-VH 2,130 Reputation points Independent Advisor

2026-09-03T05:16:51.1466667+00:00

Dear bmc,

I'm glad to hear you were able to identify the cause and resolve the issue without having to wipe or re-enroll the affected devices.

If you're willing to share, could you share what steps you used to resolve it? It would be greatly appreciated, as it may help other community members who encounter the same YubiKey and Hardware OATH issue, especially those seeing 500121 MFA failures after enrollment.

As forum member, my visibility into backend diagnostics is limited, so community-shared solutions can be extremely valuable for others facing similar problems.

Thank you in advance for any details you can provide.

Answer 2

Dear bmc,

Thank you for the details. Since the same YubiKey is still working for accounts that were enrolled two weeks ago, it suggests the key itself is functioning correctly. To help narrow this down, could you please check the following?

Did there any error message appear when the 6-digit code is rejected?
If you review the user's Sign-in logs, what is the failure reason shown for the failed MFA attempt? For reference: What are Microsoft Entra sign-in logs?

In the meantime, if the YubiKey was enrolled by an administrator on behalf of the user, please first verify that the hardware OATH token has been successfully activated in Microsoft Entra ID.

You can check this by signing in to the Microsoft Entra admin center, navigating to Entra ID > Multifactor authentication > OATH tokens, and confirming that the token status shows as Activated. If the token is listed but not activated, the generated 6-digit codes will not work for authentication.

For more information, you can refer to this article: Using YubiKeys with Microsoft Entra ID MFA OATH-TOTP

Disclaimer: This link is shared by community members for your convenience. It points to a third-party site that is not managed or verified by Microsoft. We can’t guarantee the quality, safety, or suitability of any content or software found there. Please review carefully and make sure you understand any potential risks before using it.