Microsoft Entra ID

Because the account uses Microsoft Entra multifactor authentication and there is only one administrator, the lost or broken Microsoft Authenticator registration cannot be fixed directly by signing in.

Use the following options based on the situation:

1. If there is any other global administrator in the tenant
   • Ask that administrator to reset MFA so a new Authenticator registration can be done:
     1. Sign in to the Microsoft Entra admin center as a user administrator or global administrator.
     2. Go to Entra ID > Users.
     3. Select the affected user account.
     4. Open Authentication methods.
     5. Select Require re-register multifactor authentication.
     6. Sign in again on the affected account and complete MFA setup with the new Authenticator app.
2. If truly the only administrator on the tenant
   • Self-service recovery is not possible; Microsoft must verify identity and reset MFA:
     1. Call Microsoft’s global customer service phone number from the Customer service phone numbers - Microsoft Support page.
     2. In the IVR or with the agent, clearly state:
        • The problem is with Authenticator / MFA.
        • The product is Office 365/Microsoft 365 for business.
        • It is a company (work) account, not education or personal.
        • The caller is the only administrator and is locked out at the MFA step.
        • A Data Protection / Tenant Recovery or similar team is needed to reset MFA for the tenant admin.
     3. Work with the Data Protection team to verify identity and have them reset the MFA methods on the admin account.
3. If support cannot be reached directly
   • Create a temporary trial tenant only to open a support ticket:
     1. Sign up for a Microsoft 365 trial to create a new tenant.
     2. Sign in to the Microsoft 365 Admin Center of this new tenant.
     3. Go to Support → Help & support and open a ticket.
     4. In the ticket, specify that access is needed to a different existing tenant where the caller is the only global admin but locked out at MFA, and request escalation to the Data Protection team.
     5. After the original tenant is recovered, cancel the trial subscription to avoid charges.

Until Microsoft resets the MFA registration, sign-in will continue to fail at the Authenticator step even if the password is correct.

References:

• Common problems with two-step verification for a work or school account
• Problems signing in to a Microsoft application
• Troubleshoot application sign-in
• Can't set up MFA because five devices are already registered to use an authenticator app
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• I cant log in to my business account because it is requiring Authenticator app which I do not have - Microsoft Q&A
• Global Admin Locked out - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• Authenticator Did Not Complete Login