Can't login to Azure Portal using authenticator app and other options fail

Have another authorized administrator require MFA re-registration; if no administrator or delegated partner can access the tenant, contact Microsoft Support and request escalation to the Azure Data Protection team.

1. If another administrator can sign in

Ask that administrator to:

1. Open the Microsoft Entra admin center.
2. Go to Entra ID → Users.
3. Select your account, then Authentication methods.
4. Select Require re-register MFA.
5. At your next sign-in, register Microsoft Authenticator again.

This removes the existing phone numbers, Authenticator registrations, and software OATH tokens from your account so that new authentication methods can be configured.^1^

An Authentication Administrator can perform this for ordinary users. If your locked account is an administrator account, such as a Global Administrator, the assisting account needs sufficient privileges—typically Privileged Authentication Administrator for access-related actions such as an MFA reset.^2^

If your organization uses a Cloud Solution Provider or other delegated partner, ask whether it has an active GDAP relationship with an appropriate role; such a partner may be able to restore access without Microsoft intervention.^2^

2. If you are the only Global Administrator

This is a tenant-lockout case. Contact Microsoft Support and explicitly request an Azure Data Protection team escalation for an MFA tenant lockout. Microsoft documents the Azure Data Protection number +1 866-807-5850 for the sole-Global-Administrator scenario in its Partner Center guidance.^3^

If that U.S./Partner Center route does not apply to your region or account:

• Use Microsoft’s regional customer-support directory.^4^
• Alternatively, create a support request using a different working Microsoft account and state that the affected tenant cannot be accessed.
• Provide the locked tenant ID if known, your reachable contact details, and this description:
  “No administrator can complete MFA or access the tenant. Please route this as a tenant lockout to the Azure Data Protection team.”

The Data Protection team will require proof of identity and tenant ownership before restoring access. Similar sole-admin Authenticator lockouts are handled through a support ticket followed by email or telephone contact from that team.^5^

3. If another sign-in method still works

At the MFA prompt, select Sign in another way. After signing in, open the Security info page and add a new method before removing the broken Authenticator registration. Users can manage their own methods there when they can still satisfy authentication.^1^

If no prompt reaches the phone, check that Authenticator is unlocked and current, notifications are enabled, the phone has network connectivity, and its date and time are correct.^6^

Before choosing the recovery branch, determine:

• Whether this is a work/school tenant account or a personal Microsoft account.
• Whether another Global Administrator or delegated partner can sign in.
• Whether Sign in another way offers any usable method.

For a personal Microsoft account rather than an organizational tenant, use Microsoft’s account sign-in helper/support route; Azure Data Protection tenant recovery is not the applicable path.^7^

References

1. Manage user authentication methods for Microsoft Entra multifactor authentication
2. Preventing tenant lockouts
3. Troubleshoot sign-in issues and account access problems
4. Contact Microsoft customer support
5. Tenant lockout — I am the only Global Admin and lost Microsoft Authenticator. - Microsoft Q&A
6. Authentication did not complete | Microsoft Support
7. Contact Microsoft customer support | Microsoft Support