A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation
The account is being prompted for MFA because a mandatory or tenant-wide MFA requirement is enabled, even if no per-user MFA was explicitly configured for that admin.
If the admin cannot complete MFA and there is at least one other Global Administrator in the tenant, that other Global Administrator must sign in and reset the affected admin’s MFA so it can be re-registered correctly:
- Another Global Administrator signs in to the Azure portal.
- Go to Microsoft Entra ID → Users.
- Select the locked-out admin account.
- Select Authentication methods.
- Select Require re-register multifactor authentication.
- The locked-out admin then signs in again and is prompted to set up MFA from scratch.
This does not “disable” MFA, but it clears the existing registration so the admin can enroll a working method and regain access.
If the locked-out admin is the only Global Administrator in the tenant (no other admin can perform the reset), the situation is treated as a tenant lockout. In that case, Microsoft’s Data Protection team must be engaged via a support ticket or phone support to verify ownership and help restore access to the tenant and adjust MFA as needed. Forum moderators or normal users cannot disable MFA or bypass it for that account.
If users more broadly are unable to sign in after a mandatory MFA rollout, a Global Administrator can also temporarily postpone enforcement for the tenant by running the official postponement script described in the mandatory MFA documentation. This script updates the enforcement date in Microsoft Entra ID so users can sign in and fix their MFA methods before enforcement resumes.
References:
- Can't set up MFA because five devices are already registered to use an authenticator app
- Can't use Azure Multi-Factor Authentication to sign in to cloud services after you lose your phone or the phone number changes
- You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
- How to postpone enforcement for a tenant where users are unable to sign in after rollout of mandatory MFA requirement
- Global Admin Locked out - Microsoft Q&A
- Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
- I need to reset my mfa methods - Microsoft Q&A
- I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A