Authenticator might be the worst thing ever.

The looping and lockouts usually come from how the second factor is being delivered or from stale devices/sessions, not from the Authenticator app itself. Several concrete steps can reduce or eliminate the “stuck in a loop” behavior and repeated lockouts:

1. Prefer app verification codes when possible

• The time-based verification codes in Microsoft Authenticator work fully offline and do not depend on push notifications or network reliability.
• These codes rotate every ~30 seconds by design to prevent reuse of old codes and to make attacks harder.
• When signing in, choose the option to enter a code from the Authenticator app instead of waiting for a push notification if the push flow is unreliable.

2. Fix push notifications going to the wrong device If sign-in prompts are going to an old phone, the current phone will appear “stuck” waiting:

• If an older device still has Authenticator installed and was last used, push notifications may still be sent there.
• To fix this:
  • Open Authenticator on the old device (if available) and approve the pending sign-in, then remove that device from your account.
  • Follow the steps in the “How do I make sure notifications don't go to an old device?” section of the Microsoft Authenticator FAQ to remove old devices and keep the device list up to date in your account security settings.
  • If the old device is not accessible, use another verification method (SMS, email, etc.) when offered, then clean up old devices afterward.

3. Use alternative verification methods when the app is stuck

• If the app is not responding or the notification never arrives, choose a different verification method (SMS, backup email, or security key) if your organization has allowed them.
• This lets sign-in complete so that device registrations and methods can be updated instead of repeatedly failing at the same step.

4. Keep device registration and Conditional Access in mind

• Work or school organizations often require device registration and may enforce Conditional Access policies.
• If the device is not properly registered, or if policies require a specific method (for example, Authenticator push only), sign-in can appear to loop or fail.
• In those cases, unregistering and re-registering the device in Settings may be necessary, but this can remove access to Outlook email, OneDrive files, and phone sign-in until registration is completed again.
• For work accounts, the organization’s help desk or IT admin may need to clear MFA/Authenticator registrations and let the account re-enroll cleanly.

5. Avoid common pitfalls that cause repeated prompts

• Do not leave Authenticator active on multiple phones without cleaning up old ones.
• Ensure the phone has a stable internet connection for push-based sign-in responses (Wi‑Fi or cellular). If connectivity is poor, switch to code-based verification from the app.
• If unusual activity or many repeated attempts are detected, Microsoft may temporarily block certain verification methods; in that case, switching methods or waiting out the block is required.

If the environment is a work or school tenant and there is a full lockout (no method works and there is only one admin), the resolution may require a support ticket so Microsoft can work with the tenant’s data protection process to restore access.

References:

• Microsoft Authenticator FAQs
• Common problems with two-step verification for a work or school account
• The keys to the kingdom - securing your devices and accounts
• Why didn't I receive the push notification when registering a credential in the Authenticator app?
• Cannot authenticate with E-mail when logging into Microsoft Authenticator(iOS). - Microsoft Q&A
• Having problems getting text codes to confirm my account - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A