More than 5 Microsoft Authenticator app or Token Error and We couldnt sign you in. Please try again.

Question

More than 5 Microsoft Authenticator app or Token Error and We couldnt sign you in. Please try again.

School admin 0

Hi everyone. I am very frustrated of my trouble.

I am a global admin on school tenant. I have three GlobaAdmin account on that tenant.

I cannot login to azure or entra admin center because after login by password cannot register MFA authenticator.

The wizard said "lets keep your account secure" and then didn show QR for registration bud wrote "Microsoft Authenticator cannot be set up because you already have five authenticator apps or hardware tokens".

This state is the same on all three GA accounts.

I created new fourth GA account and on first logon go to the same error about five authenticator apps or hardware tokens.

I deleted all authentication methods on the accounts using the mggraph powershell module, only the passwords remained.

I can login to https://mysignins.microsoft.com/security-info, or https://admin.cloud.microsoft.

User's image

But to entra center no, because cannot finish MFA registering.

User's image

Translate of that message is "Microsoft Authenticator cannot be set up because you already have five authenticator apps or hardware tokens If you need to delete ... contact your administrator".

User's image

I can add MFA manually by clicking on Add sign-in method, then shows me QR code and verification finish corectly.

But after adding MFA still cannot login to Entra, still asking me for "lets keep your account secure" and then shows

summary:

if global accout dont have a MFA, after login by password it failing to "Microsoft Authenticator cannot be set up because you already have five authenticator apps or hardware tokens"
if for global account manually add MFA in security info tab, I stay on "We couldnt sign you in. Please try again"

0 comments

1 answer

Your answer

Answer 1

The tenant is hitting the “maximum 5 authenticator apps or hardware tokens” limit for each Global Administrator account, and the normal registration wizard is blocked. Deleting methods only from the user’s Security info page or via basic Graph/PowerShell isn’t enough if the device tokens are still persisted on the directory object.

To unblock sign-in to Entra and Azure Portal, the authenticator app registrations must be removed at the directory level, then MFA re‑registration must be required for the affected admins.

Follow these steps for each affected admin account:

Delete existing Microsoft Authenticator registrations via Graph
- A Global Administrator must sign in to Graph Explorer as described in the “Solution 2” section of the article.
- Run a GET request to:
  - https://graph.microsoft.com/beta/users/<user-principal-name>/authentication/microsoftAuthenticatorMethods
- If a permission error occurs, grant UserAuthenticationMethod.ReadWrite.All in Graph Explorer and consent.
- In the response, copy the id (GUID) of every microsoftAuthenticatorMethods entry.
- For each id, run a DELETE request:
  - https://graph.microsoft.com/beta/users/<user-principal-name>/authentication/microsoftAuthenticatorMethods/<authenticator-id-guid>
- Confirm that each DELETE returns No Content - 204, which means the authenticator method for that device has been removed.
- Repeat for all Global Admin accounts that show the “five authenticator apps or hardware tokens” error.
Require MFA re‑registration for the admins
- In Microsoft Entra ID, an administrator who can still reach the portal should:
  - Go to Users → select the affected user → Authentication methods.
  - Select Require re-register multifactor authentication.
- This forces the next sign-in to go through a clean MFA setup flow.
Re-register MFA using Microsoft Authenticator
- Have each admin sign in again.
- When the “Let’s keep your account secure” wizard appears, register Microsoft Authenticator on a single device.
- After successful registration, access to Entra admin center and Azure Portal should work without the “We couldn’t sign you in. Please try again” loop.

If no administrator can reach the Entra admin center to perform step 2, or if the Graph deletion still doesn’t clear the limit, the remaining option is escalation through Microsoft support to the Data Protection team so they can reset the MFA state for the tenant, as described in the Q&A threads for locked-out admins.

References: