Unable to modify ANY security/2FA options on personal Microsoft Account, all operations return errors

jackrl 0 Reputation points
2026-06-15T09:15:22.1533333+00:00

I was in the process of changing phones (from Android to iOS) when I noticed that I was not able to add my personal Microsoft Account to the Microsoft Authenticator (I was able to add my work 2FAs without issue). When I tried, I logged in normally and successfully but received the following error: 'Something went wrong. Please report an issue using the "Send feedback" option and try again later.'

authenticatorfail(small)

I noticed that the Microsoft Authenticator backup function hadn't made a backup in months and tried to force the backup without success so I disabled and re-enabled it. It didn't work and I was now without the backup. At some point, weeks later, I tried again and was able to create a new backup. I was able to partially restore the backup to my Android tablet but it just shows me the 8 digit OTP code and says that "Action required: Sign in with your username and password to finish recovering this account". After successful login again, the response looks good, but when getting back to the main view with the different accounts the Microsoft Account still says "Action required".

I have since had to factory reset my old phone and give it away so I no longer have it. Luckily I have an email 2FA setup as well as SMS 2FA and my PC's passcode, so I am able to login to my account for now.

After that I decided to check my privacy/2FA settings. It seems that all of them are immutable at the moment and return unspecific errors:

  • Adding a new email for 2FA codes fails to validate the code I receive with the following error: "Please request a new security code and try again. All previous codes have been invalidated."
  • Adding another authenticator app like e.g. 1Password fails with the following error: "That code didn't work. Check the code and try again."
  • Turning Two-step verification off also fails with the following error: "Something went wrong. Sorry, something went wrong. Please try again after sometime."
  • Generating a recovery code fails with the following error: "There's a temporary problem with the service. Please try again. If you continue to get this message, try again later."

So in summary, anything an everything in the security page of the Microsoft Account management except the ability to change the password and Microsoft Authenticator seems to be stuck/blocked for my account.

It has now been two months and 5 chats with Microsoft support without a solution. Endless troubleshooting steps from a manual, of which most don't even make sense for this problem. I have waited for over a week without touching any of the 2FA settings to "unblock the account", tried different devices and browsers, incognito and private modes to no avail. Support also seems to be unable to escalate this to someone with real visibility to the account's state and end up ghosting me. In the latest chat I was told to come here to report this to get help, though given the nature of the issue, a community forum seems an unlikely place to find a resolution for what appears to be a backend account state problem..

NOTE 1: I have another old Microsoft Account for which all this works flawlessly, so this is not device related.

NOTE 2: I also have a SIR ticket (SIR23597492) that was opened on the 19th of May, for which I got an automated response telling me that "After a thorough review of your account and billing activity, we found no indication of unauthorized access or fraudulent activity.". I have tried responding to it getting only automated responses telling me that "This case is currently open, and in line to be process as soon as our engineers can get to it. We understand how important your account is to you and we will respond as soon as we can.". Despite responding to clarify this is a technical issue rather than a fraud case, all subsequent responses have been automated.

Outlook | Web | Outlook.com | Account management, security, and privacy
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-06-15T09:16:03.9966667+00:00

    The described behavior matches an account that is effectively in a protected or blocked security state where most security-info operations (adding/removing methods, generating recovery codes, changing 2FA) are temporarily disabled and only limited actions (like signing in and changing the password) are allowed.

    From the available guidance, there are only two supported paths to resolve this kind of situation for a personal Microsoft account:

    1. Use the built‑in recovery / security‑info flows and wait out any blocks For personal Microsoft accounts, security changes are tightly controlled and can be blocked for reasons such as unusual activity, high volumes of verification requests, or suspected compromised traffic:
      • Repeated or excessive requests for verification codes (email/SMS) can cause temporary or even longer blocks where codes are not accepted or delivered, and operations fail with generic errors like “Something went wrong” or “There’s a temporary problem with the service. Please try again later.”
      • In some cases, Microsoft will stop sending codes or invalidate existing ones until the block naturally expires.
      The supported actions in this state are:
      • Avoid further repeated attempts (email/SMS/Authenticator) for several days to a week, because each burst of attempts can reset the timer on the block.
      • Continue to sign in only when necessary using existing methods (email/SMS/PC sign‑in) and avoid changing security info during the cooling‑off period.
      • If access to all security info is ever lost, the only supported path is to start the recovery flow by choosing “I don’t have any of these” at the “Verify your identity” step and follow the prompts to replace security info. Once replacement is initiated, there is a mandatory 30‑day waiting period before full access to security settings is restored. During this period, only limited actions are allowed and any attempt to change security info can be blocked until the 30 days elapse.
    2. If security info has been replaced or is pending replacement, wait the 30‑day period When all security info is replaced (or Microsoft treats the account as if security info is being replaced), the account enters a 30‑day “security info change is still pending” state. During this period:
      • Most sensitive operations on the Security page are blocked, including:
        • Updating password (in some cases)
        • Updating account aliases
        • Accessing parental controls
        • Managing certain payment options
      • Access to most consumer services (Outlook.com, OneDrive, Xbox, etc.) continues, but security‑sensitive changes are not allowed until the 30 days are over.
      • If two‑factor verification is turned on, access to many of these sensitive areas is completely blocked until the pending period ends.
      In this state, the supported options are:
      • Wait for the 30‑day period to complete; after that, security settings (including 2FA methods and recovery code generation) become available again.
      • If the original security info becomes available again during the 30 days, it can still be used to sign in; doing so cancels the pending change and restores the previous security configuration.

    If none of the above flows resolve the issue and the account remains unable to modify any security/2FA options, there is no additional self‑service mechanism documented for personal Microsoft accounts beyond these automated protections and waiting periods. For business or school accounts, an administrator or the Microsoft Data Protection team can intervene, but that path does not apply to personal Outlook.com / Microsoft accounts.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.