Microsoft Authenticator Not Working? Fix MFA Loop & Disconnected Issues
What's Happening
User calls you: "I can't log in. My Authenticator won't give me a code." This happens all the time. Sometimes it just disconnects for no reason. Sometimes they got a new phone. Either way, they're stuck.
User opens Authenticator. Their account is there. But no code shows up. Just blank, or spinning. So they try signing out and back in. Now they're in a loop: enter password, MFA prompt, no code, can't get in.
I see this at least once a week. Two ways it happens:
It just stopped working
No new phone. No password change. Nothing. The app just decided to disconnect. Time sync got off? Token expired? Who knows. It happens. User blames themselves. Tell them it's not their fault.
"I got a new phone"
They set up the new phone, restored from backup. Authenticator shows their account. But still no codes. Why? Because Microsoft remembers the old phone's hardware ID. The new phone looks like an imposter. No codes until we remove the old registration.
Before You Start
Check here: entra.microsoft.com → Identity → Users → pick the user → look for "Authentication methods" on the left. If you see it, good to go.
The Fix (Takes 3 Minutes)
1. Go to the user in Entra ID
Microsoft Entra Admin Center → Users → find them → click the name
2. Click "Authentication methods"
It's in the left menu under Manage.
3. Find Microsoft Authenticator
Look in the list. It'll say "Software token" or show a phone icon.
4. Delete it
Click the three dots or Delete button. Confirm.
Delete the Authenticator entry. Leave other methods (like phone number) alone.
5. Tell user to re-add
They need to:
- Remove the old account from Authenticator app (if still showing)
- Go to https://aka.ms/mfasetup
- Sign in and follow steps to add Authenticator again
- Scan the QR code with their phone
If they're completely locked out and can't get to aka.ms/mfasetup, use "Temporary Access Pass" in Entra ID. Gives them a one-time code to sign in and set up MFA.
After the Fix
User signs in. Authenticator shows the code. They're back in. Total time: about 3-5 minutes if you have the right role.
Nothing else changes. Their emails, files, everything stays. They just need to set up Authenticator again.
Tell Users This (So You Get Fewer Calls)
- ✓ Getting a new phone? Remove your account from the old phone's Authenticator FIRST. Then set up new phone.
- ✓ Add a backup. Register a phone number too. If Authenticator breaks, they can still get in with SMS.
- ✓ If it stops working, don't sign out. Call IT. Signing out creates the loop.