Authenticator is in a constant loop, never recieve codes

Because the previous iPhone with Microsoft Authenticator is lost and there are no backup/QR codes, the old Authenticator registration cannot be removed directly by signing in; the sign-in itself is blocked by MFA. In this situation, the MFA methods for the work account must be reset by Microsoft support (Data Protection team) so that a new Authenticator registration on the new iPhone can be configured.

Use these steps depending on whether there are other admins in the tenant:

1. If there is another global admin in the tenant
   • Another global admin can sign in to the Microsoft 365 admin center and reset the MFA methods for the affected account(s), then re-enable registration so the new iPhone can be set up.
   • After the reset, sign in again with the affected account and register Microsoft Authenticator on the new iPhone when prompted.
2. If there is only one admin (you are the sole admin) and you are locked out
   • This matches the scenarios described where the only admin lost access to Authenticator and cannot complete MFA.
   • In this case, the Microsoft Data Protection team must verify identity and reset MFA from their side.
   Follow this process:
   1. Call Microsoft’s Global Customer Service phone line for your region: use the numbers listed under Customer service phone numbers - Microsoft Support.
   2. When the automated system asks what the problem is, answer along these lines:
      • Problem type: “Authenticator”
      • Product: “Office 365 for business”
      • Account type: “For companies”
      • Are you an administrator?: “Yes”
      • Are there any other administrators?: “No”
      • Do you need a service request?: “Yes – I need a ticket with the Data Protection team to reset my MFA.”
   3. The frontline agent should open a service request and route it to the Data Protection team.
   4. The Data Protection team will perform identity verification (they may ask for tenant domain, admin UPN, contact details, etc.) and then reset the MFA/authentication methods on at least one admin account.
   5. After the reset is completed, sign in again and register Microsoft Authenticator on the new iPhone when prompted, effectively replacing the old iPhone registration.
3. If phone support is hard to reach
   • As an alternative, create a temporary trial tenant and use it only to open a support ticket:
     1. Sign up for a Microsoft 365 trial tenant (for example, from the Microsoft 365 Business/Enterprise trial pages) and complete the setup.
     2. In the new tenant, go to the Microsoft 365 admin center → Support → Help & support.
     3. Open a ticket clearly stating that you are locked out of a different, existing tenant where you are the only global admin and need the Data Protection team to reset MFA on that original tenant.
     4. Provide the locked tenant’s domain, admin username, and details of the Authenticator issue.
     5. Once the Data Protection team completes the reset on the original tenant, sign in there and re-register Microsoft Authenticator on the new iPhone.
     6. Cancel the trial tenant subscription after the issue is resolved.

Until MFA is reset by another admin or by the Microsoft Data Protection team, the old iPhone’s Authenticator registration cannot be removed and the new Authenticator app will remain stuck in the loop.

References:

• Migrate to a new iPhone for work
• Troubleshoot problems with Microsoft Authenticator
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• How Do I Regain Access to My Account After Losing Access to Microsoft Authenticator? (Urgent Request). - Microsoft Q&A
• Microsoft Authenticator app doesn't show 6-digit OTP code - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A