Caught in Microsoft Authenticator loop after getting a new phone

Question

Hi everyone,

I recently got a new phone and am currently locked out of my Microsoft account due to an Authenticator MFA loop.

When I try to log into my account on my new phone, it prompts me to enter a verification code from my Microsoft Authenticator app. However, when I open the Authenticator app, it also asks me to sign in first, which immediately pushes me back to requesting a code.

Because the app is demanding a code to let me sign into the very app that generates the code, I am completely stuck.

Has anyone successfully bypassed this loop on a new device, or is there a way to force a different verification method (like SMS or backup email) when the system defaults to the app?

Thanks in advance for any help!

Answer 1

Contact your organization’s IT help desk and ask an Authentication Administrator to issue a Temporary Access Pass (TAP) or require you to re-register MFA; because this is a work or school account with no accessible alternative method or signed-in session, the loop cannot be bypassed from the new phone.

Restoring Authenticator on a new phone restores only the account name for work or school accounts, not a usable Authenticator registration, so signing in again is expected before the new device can approve requests.^1^

Preferred recovery: request a Temporary Access Pass

Send the help desk this request:

I replaced my phone and have no working MFA method or signed-in session. Please issue a Temporary Access Pass so I can register Microsoft Authenticator on the new phone. If TAP is unavailable, please require MFA re-registration for my account.

A TAP is a time-limited passcode intended for onboarding or recovering authentication methods. Microsoft recommends it instead of deleting every authentication method.^2^

Administrator steps

If TAP is already enabled:

1. Sign in to the Microsoft Entra admin center as an Authentication Administrator.
2. Go to Entra ID → Users → select the user → Authentication methods.
3. Select Add authentication method → Temporary Access Pass.
4. Set its activation and duration, then select Add.
5. Copy the TAP before closing the dialog—the value cannot be displayed again afterward.
6. Provide it to the user through the organization’s approved secure channel.^3^

If TAP is not enabled, an Authentication Policy Administrator must first go to:

Entra ID → Authentication methods → Policies → Temporary Access Pass → Enable, include the applicable user or group, and save the policy.^3^

Your steps after receiving the TAP

1. Open Microsoft Authenticator on the new phone.
2. Select Add account → Work or school account → Sign in.
3. Enter the work or school account and use the TAP when prompted.
4. Complete the prompts to register the new phone. Authenticator supports direct registration using a TAP.^4^
5. Test a fresh sign-in before removing obsolete methods.

Alternatively, open the Security info page in a browser, sign in with the TAP, and register Authenticator there. A TAP does not replace the account password; it supplies the temporary strong-authentication path needed for registration.^3^

If your organization does not use TAP

An Authentication Administrator can reset the registration:

1. Microsoft Entra admin center → Entra ID → Users.
2. Select your account.
3. Open Authentication methods.
4. Select Require re-register MFA and confirm.

This removes the registered phone numbers, Authenticator registrations, and software OATH tokens, then requires new MFA setup at the next sign-in.^5^

This is also the established recovery path for the same new-phone lockout scenario with work or school accounts.^6^

You cannot force SMS or email from the sign-in screen when no usable alternative authentication method was previously registered. Also, a profile email address is not an MFA method; Microsoft documents email as usable for self-service password reset, not authentication.^5^

If you are the sole administrator

If this account is the only administrator account and no other tenant administrator, emergency account, or delegated partner can sign in, treat it as a tenant lockout. Contact Microsoft business support using the public customer-support route; Microsoft performs tenant-ownership verification before restoring access to the existing tenant.^7^ ^8^

After access is restored, register at least one independent backup method permitted by the organization so replacing a phone does not leave Authenticator as the only path.

---

References

1. Transfer Microsoft Authenticator account entries to a new phone
2. Reset-EntraStrongAuthenticationMethodByUpn-Description
3. Configure Temporary Access Pass to register passwordless authentication methods
4. Enable passwordless sign-in with Authenticator
5. Manage user authentication methods for Microsoft Entra multifactor authentication
6. Cannot sign back into authenticator app - Microsoft Q&A
7. Plan for tenant recoverability
8. Contact Microsoft customer support