Account locked in 2FA loop – unable to access security settings

Question

Account locked in 2FA loop – unable to access security settings

Lars Walter 0

Hello,

This started back in December when I replaced my phone due to water damage (screen stopped working). While setting everything up, I ran into an issue logging into Outlook. It immediately said: “You’ve tried this password too many times, please reset it.”

This was odd because it was my first login attempt and I was using a password manager, so the password should have been correct. I reset it anyway, logged in successfully, and moved on. I also set up Authy for 2FA on the new device (which I had used on the old phone as well). My old phone also had Microsoft Authenticator configured, but I never used it, so I didn’t set it up again.

I did try to remove the old Microsoft Authenticator from my security settings, but it consistently failed with “We couldn’t remove this method.” This has been reproducible ever since. At the time I didn’t worry too much since I had three other methods configured: Authy, SMS, and a backup email (my dad’s account via family sharing).

A few days later, I tried logging into Outlook on my Mac (which had been signed out due to the password reset). Same issue: “You’ve tried this password too many times.” This didn’t make sense, as I hadn’t attempted to log in since the last successful session, and again I was using a password manager.

I checked for suspicious activity—there was none. The last login attempt was my own successful one. I reset the password again, logged into my Mac, but within minutes my phone was logged out with the same error. After another password reset, I finally got both devices working.

This pattern has repeated:

February: new Mac → same issue

Monday: new iPad → same issue

At that point I decided to properly troubleshoot instead of just resetting the password each time.

I tried going passwordless, assuming that would eliminate the “too many attempts” issue. I removed the password and set up a passkey via Bitwarden. That didn’t work—login attempts failed with a generic error. I retried setup multiple times with the same result, then removed the passkey.

After that, I needed 2FA to access security settings. That’s where things broke completely:

It still tried to use the (now removed/non-working) passkey

It also tried Microsoft Authenticator (still tied to my old phone and not removable)

My Authy setup no longer appears as an option (I did not remove it)

That leaves SMS and backup email:

SMS now returns: “Please use another method” (it worked earlier, so something changed server-side)

Backup email works, but requires a second factor—which should be SMS, but that fails

So I’m stuck in a loop:

I’m still logged in on this browser, so I can read/send email

But I cannot access or modify security settings due to broken 2FA

I waited a few days in case this was some kind of temporary lockout, but the issue persists:

Backup email works

SMS still fails with “try another method”

No other methods are available

I don’t have recovery codes saved (that’s on me), but everything else points to an issue on Microsoft’s side.

Both my dad and I work in IT, and we haven’t been able to make sense of this behavior. This is honestly one of the most frustrating account/authentication issues I’ve encountered.

Do you have any suggestions? For example, is this likely to resolve if I wait longer, or is there another way to regain access to security settings?

0 comments

1 answer

Your answer

Answer 1

Based on the described behavior, the account is effectively in a verification-method block/loop, and this will not reliably clear just by repeatedly trying the same methods. The only available options are those supported by Microsoft’s automated protection and recovery flows.

Actionable steps:

Stop repeated verification attempts

Excessive or repetitive requests to SMS or backup email can cause or extend a block where codes are not sent or are refused with messages like “Please use another method” or “Try another method.”
Wait at least 24 hours with no further sign-in or verification attempts. If the issue persists, wait longer (up to a week) before another round of attempts.

Try alternative verification methods and networks

When prompted and seeing “Try another method” for SMS, always select any other method that is still offered (even if it seems redundant) and complete the flow once, then stop.
Switch network paths when attempting sign-in or verification:
- Try from a different Wi‑Fi network.
- Try from mobile data instead of Wi‑Fi.
- Try from a different device/browser in InPrivate/Incognito mode.
These steps align with guidance for resolving “Try another verification method” and unusual-activity blocks.

Use the sign-in helper for guided troubleshooting

From a signed-in session in the browser where access is still available, run the Microsoft sign-in troubleshooter (“sign-in helper”). It is designed to detect blocks, unusual activity, and available recovery paths and will surface whatever options Microsoft currently allows for that account.
Follow its recommendations exactly once per waiting period (do not loop through it repeatedly in a short time window).

Treat this as a temporary protection block

Microsoft may temporarily block specific verification methods or the account itself due to:
- Unusual activity or patterns that differ from typical sign-ins.
- High volume of verification requests.
- Compromised or high-risk traffic from the current region or network.
These blocks are automated and clear only with time and reduced activity. There is no supported way for support agents to override them directly for consumer accounts.

If SMS remains blocked after waiting

After a full waiting period (24 hours minimum, up to a week) with no attempts:
- Try again using SMS from a different device and network.
- If still seeing “Try another method,” continue using the backup email if it works for normal sign-in, and avoid changing security settings until the block naturally clears.

If sign-in itself starts failing

If at any point sign-in fails entirely (not just security settings access), use the Microsoft account recovery form as the official path to regain access.
When using the recovery form, avoid multiple rapid submissions; each failed attempt can extend or complicate automated checks.

Given the context, there is no documented way to directly “break” the current 2FA loop from the client side beyond:

Reducing activity to allow automated blocks to clear.
Trying different verification methods and networks as suggested.
Using the sign-in helper and, if necessary, the account recovery form.

If this is a work or school account (Microsoft Entra ID) rather than a personal Microsoft account, contact the organization’s IT administrator or Help desk. They can:

Clear MFA settings on the account.
Review Microsoft Entra sign-in logs for misconfigured MFA or security blocks.

References: