A cloud-based identity and access management service for securing user authentication and resource access
Locked out of Azure Portal - personal MSA succeeds on 1st MFA factor, fails on hidden tenant's 2nd factor (8-digit vs 6-digit code)
Hi all,
I'm locked out of the Azure Portal with a personal Microsoft account and haven't been able to resolve it through phone support or a ticket submitted from another account (no engineer reachable so far). Posting here in case a moderator/MVP can help or escalate.
What happens when I sign in:
- I go to portal.azure.com and sign in with my personal Microsoft account.
- First factor (via login.live.com) works fine - I get and approve the push notification in Microsoft Authenticator.
- The portal then redirects to a second sign-in step at login.microsoftonline.com, asking me to "enter the code shown in Microsoft Authenticator."
- No push is sent for this second step, and Authenticator only shows the standard 8-digit code for my personal account, while this screen wants a 6-digit code. I have no way to satisfy this prompt.
- I can't reach aka.ms/mfasetup for this tenant/identity to fix the registration myself - it triggers the same broken challenge.
What I've tried without success:
- Alternate verification options on the sign-in screen
- Adding phone/alternate email as backup methods via account.microsoft.com/security
- Different browser / private window
- Removing and re-adding the Authenticator method
- Calling the global customer service line and asking for escalation to the Data Protection team
- Opening a support ticket from a separate trial tenant account describing this exact issue
Notably, az login with this same account still works fine from the CLI, so the account credentials/identity are valid - the problem is isolated to the second MFA factor tied to this specific tenant on the Azure Portal web sign-in flow.
Has anyone dealt with this exact "MSA-backed tenant, second-factor mismatch" scenario? Is there a way to get Microsoft to force a re-registration of MFA for this tenant identity without needing to pass this same broken challenge first? Any pointers to the right escalation path would be much appreciated.
Thanks!