Cannot get approve number matching on device.

Manually open and unlock Microsoft Authenticator while the sign-in request is active, select the correct work or school account, and check for notifications so the number-matching prompt can appear.

Try the approval again

1. Begin a new sign-in so a fresh number appears.
2. On the phone, open and unlock Microsoft Authenticator rather than waiting for a banner.
3. Confirm that the affected work or school account is listed and active, then pull down to refresh or select Check for notifications.
4. Enter the number displayed on the sign-in page and approve the request. Number matching is required for Authenticator push approvals and cannot be disabled by the user.^1^
5. If no request appears:
   • In Authenticator, open Settings → Notification Settings and enable Show notifications.
   • Disable the phone’s Do Not Disturb/Focus mode.
   • Switch between Wi-Fi and mobile data, turn off any VPN temporarily, and ensure the phone’s date and time are automatic.
   • Update Authenticator from the phone’s app store. Microsoft does not support Authenticator versions more than 12 months old.^2^

If the sign-in page offers I can’t use my Microsoft Authenticator app right now or Use a different method, use an already-registered verification code, SMS, or phone method. Do not remove the Authenticator account unless another working authentication method or your IT administrator can restore access.

If the notification remains absent

Because this is a work or school account and error 50089 continues, ask your organization’s IT administrator or help desk to reset the Authenticator registration. Provide the error code, timestamp, Request ID, and Correlation ID from the error page.

An Authentication Administrator can:

1. Open Microsoft Entra admin center.
2. Go to Entra ID → Users and select your account.
3. Select Authentication methods.
4. Choose Require re-register MFA.
5. If necessary, choose Revoke sessions.
6. Have you sign in again and register Authenticator with a new QR code.

Require re-register MFA deletes the user’s registered phone numbers, Authenticator apps, and software OATH methods, so the administrator should confirm that account recovery or a registration method is available first.^3^

Administrator diagnostic check

Before resetting MFA—or if re-registration does not resolve it—the administrator should locate this exact attempt:

1. Go to Entra ID → Monitoring & health → Sign-in logs.
2. Filter by the affected username, Failure, and the timestamp.
3. Open the matching event and compare its Correlation ID with the value shown on your error page.
4. Review Failure reason, Additional Details, and Authentication Details for the failed MFA step.

Access to these activity logs requires at least the Reports Reader role. The log’s additional details may provide the specific remediation rather than relying on error 50089 alone.^4^

If your organization recently changed your username or User Principal Name (UPN), tell the administrator. Microsoft documents that an old UPN can remain in Authenticator and prevent notifications; using Check for notifications can update it, while persistent cases may require MFA re-registration.^5^

References

1. How number matching works in MFA push notifications for Authenticator ...
2. Troubleshoot problems with Microsoft Authenticator
3. Manage user authentication methods for Microsoft Entra multifactor authentication
4. How to troubleshoot Microsoft Entra sign-in errors
5. Plan and troubleshoot UserPrincipalName changes in Microsoft Entra ID