Personal Azure account locked out after phone migration. Azure MFA still bound to old Authenticator device.

Question

Personal Azure account locked out after phone migration. Azure MFA still bound to old Authenticator device.

Whit Matthews 0

Hi,
I previously used Azure with my personal email account (@outlook.com). After switching phones and reinstalling Microsoft Authenticator, I got into my microsoft account and set my MFA back up. All microsoft services work just fine with my authenticator app, with the exception of Azure. When I try to log into the portal I'm prompted for a code, but it only accepts 6 digits while my authenticator shows 8. It gives me one other option for login - "Approve a request in Microsoft Authenticator", but of course that request never arrives, presumbably because Azure is using my stale Authenticator info.

I've tried every self-fix I can find on forums, searches, and with AI: incognito windows, different paths into the Azure portal, registering other methods of MFA - it all results in the same thing: getting stopped at the Azure portal authentication with it asking for a code I can't give it.

From what I've seen on other similar questions and from my troubleshooting with Copilot, I'm told the only route is to ask a question on here with the hope that the request can be forwarded to the Data Protection / tenant recovery team for an MFA reset.

Can anyone help me with this request?

Thank you!

UPDATE: Sole Global Administrator Locked Out of Existing Azure/Entra Tenant Following Phone Migration | AADSTS500121, AADSTS16000, AADSTS50020

I'm providing additional findings from extensive troubleshooting. This is a sole-administrator lockout of an existing Microsoft Entra ID tenant, not a general Microsoft account recovery issue.

My personal Microsoft account remains fully functional, but I cannot complete MFA to access my Azure tenant. I have exhausted the available self-service recovery options and have been unable to obtain meaningful assistance through Microsoft telephone support.

I'm requesting assistance from a Microsoft moderator or support engineer who can initiate a Data Protection / tenant administrator recovery escalation.

1. Confirmed Tenant Information

Tenant name: Default Directory

Tenant ID: 5d87f9b8-9105-4bab-98a9-c027802c954c

Tenant domain: whitmatthewsoutlook.onmicrosoft.com

Tenant type: Workforce

Associated administrator account: ******@outlook.com

Administrator status: I am the only user/administrator of this tenant. There is no alternate administrator who can reset my MFA registration.

Tenant history: This is an existing Azure tenant that I have successfully accessed and used in the past.

I can confirm the tenant exists because it appears in Azure Portal under Portal settings → Directories + subscriptions → All Directories.

2. Original Trigger: Phone Migration

This issue began after migrating to a new phone.

During migration, I had to reinstall Microsoft Authenticator, re-add my personal Microsoft account, and reconfigure authentication methods.

My Microsoft account continues to work normally with:

Outlook.com

account.microsoft.com

Microsoft 365 Personal and other consumer Microsoft services

However, I cannot authenticate into my Azure/Entra tenant.

The Microsoft Authenticator app currently displays an eight-digit code for my personal account, while Azure requests a six-digit verification code.

The only authentication alternatives presented by Azure are:

Approve a Microsoft Authenticator push notification, which never arrives.

Enter a six-digit verification code, which is unavailable in my current Authenticator registration.

I no longer have access to the previous phone.

Additional authentication methods configured under my consumer Microsoft account are not offered during Azure sign-in.

This suggests that my existing tenant may still be associated with an Authenticator registration from the previous phone, although I cannot independently confirm the registration state.

3. Primary Authentication Failure: AADSTS500121

I explicitly attempted to access my existing Azure tenant using its tenant-specific portal URL:

https://portal.azure.com/5d87f9b8-9105-4bab-98a9-c027802c954c

This reached a Microsoft Entra identity verification screen, where authentication failed.

Error details:

Error code: 500121

Request ID: efd04272-458a-4f2a-a921-97d7ec99a900

Correlation ID: 01a1b768-e841-7570-8ead-8793f9edfaf2

Timestamp: 2026-11-07T19:08:06Z

The error message states:

"Sorry, we're having trouble verifying your account. Please try again."

The only available methods are Authenticator push notification and a six-digit verification code. Neither is usable.

This is the primary error preventing access to my own tenant.

4. Secondary Authentication Errors: AADSTS16000 and AADSTS50020

I discovered that the Azure Portal frequently defaults to a different directory:

Directory: Microsoft Services

Tenant ID: f8cdef31-a31e-4b4a-93e4-5f571e91255a

This is NOT my Azure tenant.

When the portal attempts to obtain access tokens for certain extensions, it generates the following errors:

AADSTS16000:

"User account from identity provider 'live.com' does not exist in tenant 'Microsoft Services' and cannot access the application in that tenant. The account needs to be added as an external user in the tenant first."

AADSTS50020 / invalid_grant:

"The logged in user is not authorized to fetch tokens for extension 'Microsoft_AAD_DXP' because the user account is not a member of tenant 'f8cdef31-a31e-4b4a-93e4-5f571e91255a'."

Affected components include:

Azure Portal (c44b4083-3bb0-49c1-b47d-974e53cbdf3c)

Microsoft Azure Support Portal Extension (e6694c91-1590-4e35-9bb7-b865c638b9c1)

Microsoft_AAD_DXP / identity.diagnostics

Microsoft_AAD_IAM

Example diagnostic identifiers from the Azure Support extension:

Trace ID: daed0b77-0dfb-4ba9-9d11-24644e491300

Correlation ID: 5819904b-db03-40d6-9a70-329ae59ea1de

Timestamp: 2026-11-07T19:33:03Z

Example diagnostic identifiers from the Entra diagnostics component:

Trace ID: 8fce1482-07dc-4731-90aa-74e66c322701

Correlation ID: 1fdeeb7d-a716-4c45-bc88-24f92c812fd2

Timestamp: 2026-11-07T19:34:57Z

I understand these errors may result from the portal operating in the Microsoft Services tenant rather than my actual tenant. They may be secondary to the primary MFA problem.

5. Partial Portal Access

Interestingly, I can sometimes load portions of both:

https://portal.azure.com

https://entra.microsoft.com

The interfaces recognize my personal Outlook.com account.

From Azure Portal, I can navigate to:

Portal settings → Directories + subscriptions

This page lists my actual tenant:

5d87f9b8-9105-4bab-98a9-c027802c954c

However, selecting Switch immediately initiates an MFA challenge that I cannot complete.

The Entra admin center also partially loads, but administrative operations fail because the portal cannot obtain the necessary access tokens.

For example:

Opening my user profile produces an extension error.

The Entra dashboard may display zero users/groups while operating in the Microsoft Services context.

Opening the support interface triggers additional authentication errors.

Repeated "Interaction required" popups prevent normal operation.

Consequently, the fact that the portal interface loads does NOT mean I have functional administrative access to my tenant.

6. Troubleshooting Already Completed

Microsoft account and Authenticator:

Reinstalled Microsoft Authenticator.

Re-added my personal Microsoft account.

Reconfigured available authentication methods.

Verified the consumer Microsoft account and Authenticator work normally.

Confirmed that Azure does not offer the consumer account's other configured authentication methods.

Verified that the previous phone is no longer available.

Browser and sign-in testing:

Tested fresh InPrivate/Incognito sessions.

Tested Azure Portal and Entra admin center.

Attempted tenant-specific Azure Portal access.

Attempted to switch directories manually.

Attempted Entra security information access.

Attempted MFA setup through Microsoft-provided endpoints.

Account activity:

Reviewed Microsoft Account Recent Activity.

Consumer service sign-ins appear normally.

Azure authentication attempts have not appeared in the consumer account activity I reviewed.

Support and recovery:

Contacted multiple Microsoft support telephone numbers, without obtaining an actionable tenant recovery case.

Posted this Microsoft Q&A question.

Attempted administrator recovery shortcuts including:

https://aka.ms/AdminRecovery

  `https://aka.ms/TenantRecovery`
  
     `https://aka.ms/cloud-admin-recovery`
     
     These recovery links redirect to Bing rather than opening a recovery workflow.
     
     Attempted to access Azure/Entra support from the partially functional portals, but token acquisition failures prevent normal access.

I have been unable to reach a support representative who can initiate an appropriate administrator recovery process.

7. Specific Assistance Requested

I am requesting escalation to the Microsoft team responsible for sole-administrator Microsoft Entra tenant lockouts, potentially Data Protection / Tenant Recovery.

Specifically, I need assistance with:

Verifying ownership and administrative control of tenant 5d87f9b8-9105-4bab-98a9-c027802c954c.

Reviewing the authentication methods associated with my tenant administrator identity.

Determining whether a previous Microsoft Authenticator device registration is preventing successful MFA.

Resetting or restoring the tenant administrator's MFA registration through Microsoft's authorized recovery process.

Restoring administrative access to the existing tenant without creating a replacement tenant or losing existing Azure resources.

I am prepared to provide ownership verification, historical subscription and billing information, authentication logs, screenshots, and any other verification details through an appropriate private Microsoft support channel.

Could a Microsoft moderator or support engineer please initiate or facilitate an actual Data Protection / tenant recovery support case, or identify the specific supported escalation procedure for a sole administrator whose personal Microsoft account is the administrator identity?

I specifically need assistance recovering the existing Entra tenant, not resetting my consumer Microsoft account password or reconfiguring Authenticator for Outlook.com.

Please provide a support case number or an actionable route to the responsible recovery team.

Thank you.