How to get past authenticator if you don’t have access to it

Access to the email account cannot be regained through Microsoft Authenticator alone if there is no access to the app on any device. Use one of the following supported paths instead, depending on the type of account and what is still available.

1. Try another verification method

• If two-step verification or passwordless is enabled, other methods may still be configured (SMS, email code, security key, or Outlook for Android notifications).
• At the sign-in screen, after entering the username and password, choose Other ways to sign in (or similar) and select another method such as SMS or email code if it appears.
• Complete sign-in using that alternative method.

2. If the old phone or another device still has Authenticator

• If the Microsoft Authenticator app is still active on an older phone, the push notification may be going there instead of the new phone.
• Open Authenticator on the old device and approve the sign-in.
• After signing in, remove the old device from the account security settings and add the new phone.

3. If Authenticator credentials cannot be restored

• If backup/restore for Authenticator was not set up, and there is no access to the backup account, account credentials in Authenticator cannot be recovered.
• In that case, accounts must be added again manually after access to the Microsoft account is restored by another method.

4. If locked out of a work or school (business) account and no alternative method works

• If this is a work or school account and there is an organization admin:
  • Contact the organization’s Help desk or Microsoft 365/Entra administrator and ask them to reset the MFA settings for the user account in the Entra Admin Center. After reset, sign-in will prompt to set up Authenticator again.
• If this is a business tenant and the user is the only global admin and is fully locked out (no other methods work):
  • Contact Microsoft support by phone using the published customer service phone numbers and request escalation to the Data Protection team to reset the admin’s authentication methods.
  • If a support request cannot be opened from the locked tenant, a temporary trial tenant can be created and a support ticket submitted from there, clearly stating that access is needed for a different existing tenant where the user is the only admin.

5. If locked out of a personal Microsoft account and no methods work

• Use the Microsoft account sign-in helper to attempt account recovery and regain access to the backup account used for Authenticator backup.
• If recovery of the backup account is successful, re-add accounts to Authenticator on the new phone.

6. Future protection steps

• When changing phones, always remove Authenticator from old devices and keep the device list up to date in account security settings.
• Configure more than one sign-in method (e.g., Authenticator plus SMS or email codes) so that loss of one method does not fully block access.

References:

• How to go passwordless with your Microsoft account
• Sign in using Microsoft Authenticator
• Microsoft Authenticator FAQs
• Restore account credentials from Microsoft Authenticator
• Using Outlook mobile to sign in
• Common problems with two-step verification for a work or school account
• How Do I Regain Access to My Account After Losing Access to Microsoft Authenticator? (Urgent Request). - Microsoft Q&A
• Cannot authenticate with E-mail when logging into Microsoft Authenticator(iOS). - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A