How can I reset my password when MFA is enabled?

Stop all sign-in, password-reset, SMS, Authenticator, and recovery-code attempts for at least 24 hours, then make one recovery attempt using the dedicated 25-digit recovery-code route rather than entering the code at the ordinary MFA prompt.

After the lockout period

Repeated verification requests can trigger or prolong a temporary block. Microsoft recommends waiting one day without making repeated attempts; if the block remains after 24 hours, wait longer—potentially up to one week—before trying once more.^1^

Then use this exact sequence:

1. Start signing in to your Microsoft account.
2. Select Other ways to sign in.
3. Select Use my password.
4. Select Forgot password?
5. Select Use a different verification option.
6. Select I don't have any of these.
7. At Do you have an account recovery code?, enter the 25-digit recovery code.
8. If accepted, set a new password.

Spaces, dashes, and capitalization are not required. Only the most recently generated recovery code is valid; generating a replacement invalidates every earlier code.^2^

Because two-step verification is enabled, replacing security information through this route can impose a 30-day waiting period before the change takes effect.^2^

If the recovery-code route still reports a temporary server problem

Before the next single attempt:

• Update Microsoft Authenticator from the phone’s app store.
• Restart the phone after confirming automatic date and time. Since automatic time is already enabled, do not reset it again.
• Switch between Wi-Fi and mobile data, disable any VPN, and ensure Airplane mode is off.
• In Authenticator, open Settings and use Send feedback to submit diagnostic logs before contacting Support.

Microsoft also recommends current Authenticator and device versions, correct date/time, working connectivity, and disabling battery optimization where available.^3^

Do not remove the account from Authenticator while locked out. The available documentation does not establish that it can be re-added without signing in, so removal could eliminate a usable credential.

Recovery and support limits

Do not submit the account recovery form again. Microsoft explicitly states that when two-step verification is enabled and none of the registered verification methods can be used, that form cannot bypass MFA. Support agents also cannot issue a password-reset link or change the account’s security information.^4^

For a normal MFA password reset, Microsoft requires two verification methods. The second verification can be Authenticator or another registered method, depending on the security information already attached to the account.^5^

If the recovery code remains rejected after a sufficiently long no-attempt period:

1. Run the Sign-in Helper once to see whether Microsoft offers another verification route.
2. Select Contact Support from the resulting support flow.
3. Report:
   • that this is a personal Microsoft account;
   • the exact temporary-server error;
   • that SMS succeeds but the second factor fails;
   • that both Authenticator and the newest 25-digit recovery code fail;
   • how long no attempts were made;
   • that Authenticator diagnostic feedback was submitted.

Support may investigate the Authenticator or service error, but it cannot manually override two-step verification or modify the account.^5^

References

1. Troubleshoot Microsoft verification code issues | Microsoft Support
2. https://support.microsoft.com/en-us/accounts-billing/manage/how-to-get-a-microsoft-account-recovery-code
3. https://support.microsoft.com/en-us/authenticator/troubleshoot-problems-with-microsoft-authenticator
4. Help with the Microsoft account recovery form | Microsoft Support
5. How to use two-step verification with your Microsoft account | Microsoft Support