Error Code: 399287 MFA via SMS not working - BadReputation

Kristian Bentsen Kjærgård (KBK) 65 Reputation points
2026-06-09T20:51:06.5466667+00:00

We are experiencing an issue with MFA via SMS in our tenant and have been for the past week or so. When attempting to use SMS for MFA, the authentication fails with the following error:

{"Success":false,"ResultValue":"BadReputation","Message":"BadReputation","AuthMethodId":"OneWaySMS","ErrCode":399287,"Retry":false,"FlowToken":"Removed","SessionId":"","CorrelationId":"3c2c1380-15ba-4f89-9a24-550759fb363e","Timestamp":"2026-06-09T12:45:13Z","Entropy":0,"ReselectUIOption":0,"ContinuationToken":null,"MobileAppAuthDetails":null}

Multiple accounts including all admins are currently unable to access the tenant, being locked out by the error above.

Request: Unblock the tenant from the Azure Phone Fraud Protection system, making us able to use the SMS MFA to regain access again.

I'm able to provide email address, phone number, tenant id, country and country code if requested via a private message. We are unable to contact the Data Protection team, as when we get through the AI assiatants, the phone is hung up from their side for some reason.

Thank you in advance.

Best regards,

Kristian

Community Center | Not monitored
Answer accepted by question author
Rukmini 43,915 Reputation points Microsoft External Staff Moderator
2026-06-09T21:29:57.4733333+00:00

Hello @Kristian Bentsen Kjærgård (KBK)

Thank you for sharing your details(user's email address, tenant id, phone number, country code and country) with us over Private Message

I have reached out to the engineering team to unblock MFA for your account. They have now unblocked it from the backend and removed the bad reputation on it. You should be able to log in to the Azure Portal without any issues.

Please try logging in and check if you can complete SMS authentication without any errors. Let me know if you encounter any issues.

As a best practice, I recommend registering the Microsoft Authenticator method for your account instead of relying on SMS. SMS and voice call authentication methods are more vulnerable to IRSF attacks (telephony fraud) and are generally less secure.

For better practice, I recommend registering with Microsoft Authenticator method to your account instead of SMS method as these SMS/Voice telecom auth methods are susceptible to IRSF attacks telephony fraud.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the resolution was helpful, kindly take a moment to click on 210246-screenshot-2021-12-10-121802.pngand click on Yes for was this answer helpful. And, if you have any further query do let us know.

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Oldest
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.