unable to reset MFA for one of my organization mailbox in Azure console. error Value of unique property 'ProxyAddresses' with ObjectId '28b36d98-etc...'

The error about the unique property ProxyAddresses is unrelated to the actual MFA reset; focus on resetting the user’s MFA methods instead of changing the mailbox or proxy addresses.

Given that:

• The user cannot get codes from Microsoft Authenticator
• No alternative sign-in method works
• Resetting/deleting MFA methods in the Azure/Entra portal is failing

Use one of the supported recovery paths below.

1. Try a standard MFA re‑registration reset (if not already done)

• In the Azure portal, go to Microsoft Entra ID → Users → [select the user] → Authentication methods.
• Select Require re-register multifactor authentication.
• Have the user sign in again; they should be prompted to set up MFA from scratch.
• If this still fails or you cannot delete the existing methods, proceed to step 2.

2. Delete the user’s Authenticator registrations via Microsoft Graph (admin required) If you are a Global Administrator and portal-based deletion is not working, delete the Microsoft Authenticator methods directly using Microsoft Graph:
3. Go to Graph Explorer and sign in as a Global Administrator.
4. In the query area:
   • Set HTTP method to GET.
   • Use this query (replace with the user’s UPN): https://graph.microsoft.com/beta/users/<user-principal-name>/authentication/microsoftAuthenticatorMethods
   • Run the query.
5. If a permission error appears, in Modify permissions → Open the permissions panel, grant UserAuthenticationMethod.ReadWrite.All and Consent, then run the query again.
6. In the response, copy the id (GUID) for each authenticator method.
7. For each id, run a DELETE query:
   • Set HTTP method to DELETE.
   • Query: https://graph.microsoft.com/beta/users/<user-principal-name>/authentication/microsoftAuthenticatorMethods/<authenticator-id-guid>
   • Run the query and confirm a 204 No Content response.
8. After all authenticator methods are deleted, have the user sign in again and complete MFA setup with a fresh Authenticator registration and/or an additional method (phone/SMS) so they are not locked out again.
9. If there is no other Global Admin or Graph access fails If this user is the only Global Admin and you cannot perform the steps above, or all admin-side resets fail, the tenant’s MFA reset must be handled by Microsoft’s Data Protection / Tenant Recovery team via a support case or phone call, as shown in the referenced Q&A threads. A support engineer can verify tenant ownership and reset MFA from the backend.
10. General guidance for the user’s Authenticator app

• If the user sees no 6‑digit OTP and only push approvals, the account may be configured for passwordless or push-only; once the old registration is removed (via steps above), a new registration will restore proper codes/approvals.
• Ensure the user keeps at least one additional MFA method (phone call/SMS) configured to avoid future lockouts.

References:

• Can't set up MFA because five devices are already registered to use an authenticator app
• Common problems with two-step verification for a work or school account
• I need to reset my mfa methods - Microsoft Q&A
• Global Admin Locked out - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A
• Microsoft Authenticator app doesn't show 6-digit OTP code - Microsoft Q&A
• Use a screen reader to set up and troubleshoot multifactor authentication
• Microsoft Curate - Troubleshoot Multi-Factor Authentication (MFA)
• Microsoft Monetize - Troubleshooting MFA
• Microsoft Invest - Troubleshoot Multi-Factor Authentication (MFA)