Unable to access Azure subscription due to lost Microsoft Authenticator and overdue invoice

Use Azure’s support-request channel that does not require Azure portal sign-in to address the MFA lockout and overdue invoice together: create a support request. Microsoft documents this route specifically for customers who cannot sign in to the Azure portal.^1^

In the request, provide the subscription ID, invoice number, tenant/domain, reachable email and phone number, and explain that the registered Authenticator device was damaged. Do not post those details publicly.

Recover access

Choose the applicable route:

1. If another administrator exists: Ask an Authentication Administrator to open Microsoft Entra admin center → Entra ID → Users → affected user → Authentication methods → Require re-register MFA. This removes the affected authentication methods and prompts you to register the new phone at your next sign-in.^2^
2. If you are the only administrator: State that this is a tenant lockout and request an Azure Data Protection/account recovery escalation. Microsoft’s account-access guidance directs the only global administrator to the Azure Data Protection team.^3^
3. If Authenticator backup was enabled before the phone was damaged: Restore using the same device type—iOS backup to iOS or Android backup to Android. For work or school accounts, only the account name is restored, and sign-in/reverification is still required; installing Authenticator alone does not recreate the MFA registration.^4^

Payment retry

The available Azure billing documentation confirms that a declined charge places the invoice in Past due status, but it does not specify a guaranteed automatic retry schedule.^5^ Do not rely on an automatic retry; ask billing support whether another attempt is scheduled for this particular billing account.

After access is restored, if this is a pay-as-you-go Microsoft Online Subscription Program account:

1. Open Azure portal → Cost Management + Billing → Invoices.
2. Select Settle balance; some regions display Pay now instead.
3. Select the existing card or Add new payment method.
4. Select Pay.

The account administrator must perform this payment. The selected card becomes the active payment method for subscriptions using the failed method.^6^

Restoring funds might not be sufficient if the bank blocks the transaction. Ask the card issuer to confirm that the card permits international and recurring transactions and has enough available credit.^7^

If the invoice remains unpaid

A subscription with a Past Due status remains active initially, but continued nonpayment can cause it to be disabled.^8^ When disabled, resource creation and management are blocked; virtual machines are deallocated, temporary IP addresses are released, storage becomes read-only, and other services are disabled. Depending on the subscription type, a disabled subscription can remain in that state for 1–90 days before permanent deletion.

For the documented pay-as-you-go lifecycle, the service is eventually canceled, resources become unavailable, and Azure data is deleted 90 days after the service ends.^6^ Treat billing and recovery notifications as urgent because the exact timing depends on the billing account and subscription type.

After payment, reactivation can take up to 24 hours. If the subscription remains disabled after that period, update the existing billing-support case.^9^

References

1. Troubleshoot Azure subscription sign-in issues
2. Manage user authentication methods for Microsoft Entra multifactor authentication
3. Troubleshoot sign-in issues and account access problems
4. [iOS](https://support.microsoft.com/authenticator/restore-account-credentials-from-microsoft-authenticator#i-see-sign-in-to-restore-your-account-after-restoring-authenticator-accounts)
5. View and download your Microsoft Azure invoice
6. Resolve a past-due balance for your pay-as-you-go Azure subscription
7. Troubleshoot Azure payment issues
8. Azure subscription states
9. Reactivate a disabled Azure subscription