Microsoft Authenticator is asking me to authenticate using Microsoft Authenticator to use Microsoft Authenticator

I've found some threads on Q&A forum about this very issue

https://learn.microsoft.com/en-us/answers/questions/526467/flaw-in-authenticator

https://learn.microsoft.com/en-us/answers/questions/1181201/authenticator-login-loop

https://learn.microsoft.com/en-us/answers/questions/464194/authenticator-app-sign-in-requires-authenticator-a

https://learn.microsoft.com/en-us/answers/questions/1251417/blocked-by-microsoft-authenticator-in-a-loop

https://learn.microsoft.com/en-us/answers/questions/457121/cant-login-to-authenticator https://learn.microsoft.com/en-us/answers/questions/1025256/authenticator-non-ending-loop

None of them have a solid answer on how to rectify the problem except for this one: https://learn.microsoft.com/en-us/answers/questions/1078084/aad-tenant-lock-out-due-to-authenticator-app-reset which suggests calling MS Support.

I called MS Support for my country (NZ) and got the following phone menus

1 Home users 2 Business users1 Microsoft 365 products such as Sharepoint Online1 Use business email address containing company domain1 Technical support2 Billing subcriptions or activations3 Purchase microsoft solutions for business use4 Cancel subscription2 Personal email address - hotmail, outlook, MSN3 Microsoft partner network2 All other enquiries1 Product activation2 Technical support3 Licensing assistant4 To purchase microsoft solutions for business use5 Visual studio, mirosoft certifications, academic programs3 Microsoft Partner Network members

2, 1, 1, 2 - Got through to someone who told me to hang up and choose 'Azure' from the phone menu (which as you can see, doesn't exist)

2, 2, 2 - Got an automated message telling me to contact Microsoft online. Uhhm, no, that doesn't work. 2, 1, 1, 1 - Got through to someone who told me to get my administrator to deactivate the authenticator app via the Azure Administrator Portal (or something like that), and if the admin themselves had trouble, to call MS support Global Customer Service numbers.

I will try to get my manager (who is our Microsoft admin) to call customer service and see if he can get my Authenticator deactivated.

AniOR - I suggest calling MS Support and choosing 'Home user' option, see if they can help.

Well this is frustrating. 2023 and can't even log into an account for one of the world's biggest companies. Cmon Microsoft.

Hi, and thank you for your reply! Very appreciated!

There are in fact only two choices when choosing alternative ways to log in.

One is to continue to use the "preferred method" which is Microsoft Authenticator, and the other is "Switch to Microsoft Authenticator"... go figure...

Well, the solution for me was for the domain administrator to disable 2FA on my account, and re-enable it, to reset it. Then I could register the app correctly again on my new phone, and all is well and wonderful in Microsoft-land again :)

I have just enabled backup to cloud now, so hopefully I will not hit the same wall again in the future :)

Tormod

For me I realized I just tried to sign into azure and it suddenly worked. I believe something was quietly fixed.

Overall, even for one user accounts like mine, I’m the admin and should not be referred to some other admin, at least the system should know such accounts and provide the other options. The problem is the other options do not show up in some cases especially with something like azure. Also the Authenticator appears to have different policies when using Microsoftonline vs live.

To shed some light on this from a SysAdmin/IT Manager.

1. You do not need to sign in to the MS Authenticator app unless you are using the account to back up your authenticator connections. This is useful when transferring to a new phone or if your device gets factory reset or the app gets uninstalled.
2. When you add your work or school account for MFA, it is is by a url or QR Code and you do not need to sign into the app for this. Just go to the account in your Authenticator list and tap it to get your code. You can access this by tapping "Authenticator" at the bottom of the app.
3. If you still want to use your work account to login to Authenticator you will need to set up a secondary MFA such as a text message. Then select you don't have access to authenticator and use the alternative method.

The loop is just a misunderstanding of how the application works. If you are signing in to MS Authenticator (or anything really) with an MFA enabled account you will need to meet the requirement for strong authentication ether by conditional access policies set by IT such as being on a corporate trusted network or by completing the sign in challenges (Text, Call, Security Key, or Authenticator code). Allowing a sign in to authenticator without these requirements is a huge security risk and would lead to compromised accounts. What would prevent a hacker from using a brute force method on an authenticator to gain access to your account if this process wasn't in place.

We are reaching a point where passwords are meaningless and additional factors are absolutely necessary for all sign-ins. We only have ourselves to blame. When the most common passwords are things like 12345678 or password1 or forced complex passwords result in things like Password12345678! IT admins have no choice but to enact new methods to secure the org and its data. We really only have our own bad password habits to blame for the complexity being introduced for sign-in's.