Unable to access Azure AD B2C tenant after phone reset – MFA configured on old device

Question

Unable to access Azure AD B2C tenant after phone reset – MFA configured on old device

Cheeday Durga Sai Krishna Jagadeesh 0

Hello Team,

I am unable to access my Azure AD B2C tenant because Multi-Factor Authentication (MFA) is still linked to my old mobile device.

Recently, I reset/replaced my phone, and the Microsoft Authenticator app configuration was lost. Now, whenever I switch to my Azure AD B2C tenant, it prompts for MFA approval from the old device, which I no longer have access to.

Issue details:

Azure AD B2C tenant access blocked due to MFA

Old phone/authenticator is unavailable

Unable to register MFA on new device because sign-in itself requires MFA

Need assistance to reset/re-register MFA for my account or provide an alternate recovery method

Please help me regain access to the B2C tenant and configure MFA on my new phone.

Thank you.

Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator

2026-05-12T07:51:45.7866667+00:00

Cheeday Durga Sai Krishna Jagadeesh

Thank you for reaching out to Microsoft Q&A.

Based on the details you’ve shared, this appears to be a tenant lockout scenario.

To resolve this, the recommended approach is to contact the Microsoft Data Protection team. You can reach them by calling Microsoft Customer Service using the phone numbers listed here: https://support.microsoft.com/en-us/topic/customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2

If you have access to another tenant or subscription where you still have Global Administrator privileges, you may also raise a support request from there to get assistance in restoring access to the affected tenant.

For future reference and to help prevent tenant lockouts, please check: https://learn.microsoft.com/en-us/partner-center/customers/gdap-preventing-tenant-lockouts

If neither option is possible, let us know, we are happy to assist you further!
Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator

2026-05-13T05:35:10.97+00:00

Cheeday Durga Sai Krishna Jagadeesh

Following up to check if the resolution provided was helpful. Let us know if you need any further assistance.

1 answer

Your answer

Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator

2026-05-12T07:51:45.7866667+00:00

Cheeday Durga Sai Krishna Jagadeesh

Thank you for reaching out to Microsoft Q&A.

Based on the details you’ve shared, this appears to be a tenant lockout scenario.

To resolve this, the recommended approach is to contact the Microsoft Data Protection team. You can reach them by calling Microsoft Customer Service using the phone numbers listed here: https://support.microsoft.com/en-us/topic/customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2

If you have access to another tenant or subscription where you still have Global Administrator privileges, you may also raise a support request from there to get assistance in restoring access to the affected tenant.

For future reference and to help prevent tenant lockouts, please check: https://learn.microsoft.com/en-us/partner-center/customers/gdap-preventing-tenant-lockouts

If neither option is possible, let us know, we are happy to assist you further!
Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator

2026-05-13T05:35:10.97+00:00

Cheeday Durga Sai Krishna Jagadeesh

Following up to check if the resolution provided was helpful. Let us know if you need any further assistance.

Answer 1

Because the Microsoft Authenticator app is tied to the old phone, the existing MFA methods must be reset before access to the tenant can be restored and MFA can be configured on the new device.

Use the following options based on the admin situation in the tenant:

If there is another cloud/global admin in the tenant
1. Ask that admin to sign in to the cloud service portal as an admin.
2. Have them go to the Azure MFA user management page: https://account.activedirectory.windowsazure.com/usermanagement/multifactorverification.aspx.
3. They should select the checkbox for the affected admin account.
4. Select Manage user settings.
5. Select Require selected users to provide contact methods again, then select Save.
6. After this reset, sign in again; the account will be prompted to set up MFA methods from scratch on the new phone (for example, by adding the Microsoft Authenticator app or a phone number).
If there is no other admin and this is a tenant lockout
- This is a tenant lockout scenario where no other global admin can reset MFA. In such cases, Microsoft support must involve the Data Protection team to restore access.
- Open a support case with Microsoft (for example, via a phone call to Global Customer Service or via a support ticket from another tenant, as described in the referenced Q&A). Clearly state that:
  - Access to the only global admin account is blocked by MFA on a lost/reset phone.
  - A reset of the MFA/authentication methods for the tenant admin is required.
- The Data Protection team will contact by email or phone and work with the tenant owner to verify identity and reset the MFA configuration so that sign-in can succeed and MFA can be re-registered on the new device.
After MFA is reset
- Once access is restored and sign-in succeeds without the old MFA, immediately:
  - Reconfigure MFA methods (Microsoft Authenticator, phone, etc.) on the new phone.
  - Optionally add backup methods (such as an alternate phone) to avoid lockout if the primary device is lost again.

References: