Cannot sign in to Azure from my main development machine

Keep the laptop’s authenticated Azure session open and use it to replace the Microsoft Entra MFA registration; the eight-digit personal-account code and the six-digit Azure prompt belong to separate authentication contexts.

1. Try the least disruptive recovery from the laptop

Do not sign out, clear cookies, or remove the Authenticator account yet.

1. On the laptop, open https://aka.ms/MySecurityInfo.
2. Confirm that the page opens in the Azure tenant context and shows Security info for the affected identity.
3. Add a new Microsoft Authenticator method and select Work or school account in Authenticator when scanning the QR code.
4. Complete the test notification, then make the new method the default if that option is available.
5. Only after the new method works, remove the stale tenant-side Authenticator registration.

Microsoft Entra maintains its own Authenticator registrations, independently of the SMS, email, and Authenticator methods at account.microsoft.com. Personal and work/school account information is not synchronized, although a personal Microsoft account can exist as a guest in an Entra directory.^1^ The Entra Security info page is the supported location for managing notification and verification-code registrations.^2^

If this succeeds, open a private browser window on the development machine and sign in to Azure again. Complete the newly registered Entra prompt. If private browsing works, remove only the affected Microsoft sign-in site data from the normal browser profile rather than clearing all browser data.

2. If Security info requires the unavailable MFA method

Use another appropriately privileged administrator to force MFA re-registration. Merely having a working laptop session does not mean that session can reset its own methods, create users, or assign directory roles.

Prefer an existing authorized administrator:

• If the affected identity has a privileged administrator role, use another Global Administrator or Privileged Authentication Administrator.
• An Authentication Administrator is appropriate only where its role scope permits management of the affected non-privileged user.

From the other administrator account:

1. Open Microsoft Entra admin center.
2. Go to Entra ID → Users.
3. Select the affected user or guest object.
4. Select Authentication methods.
5. Select Require re-register MFA, then confirm.
6. Start a fresh Azure sign-in for the affected account and register Authenticator as a Work or school account.

This operation removes the user’s registered phone numbers, Authenticator apps, and software OATH tokens, so those methods must be registered again.^3^ A closely matching recovery case was resolved by resetting MFA on the personal account’s guest user object in the tenant.^4^

3. If there is no other administrator

If the laptop session still has authority to create users and assign directory roles, a temporary recovery administrator can perform the reset. This is a last-resort, high-privilege action:

1. Create a unique recovery user with a strong password.
2. Assign Global Administrator only for the recovery period.
3. Register MFA on that account immediately.
4. Use it to require MFA re-registration for the affected identity.
5. Review the relevant audit activity, then remove or demote and disable the recovery account as soon as access is restored.

Do not attempt this unless authorized to administer the tenant. If the laptop session cannot create users or assign roles, proceed directly to support.

4. Open support while the laptop session still works

From Azure Portal on the laptop:

1. Select ? in the global header.
2. Describe the problem as Microsoft Entra tenant MFA lockout / Authenticator registration mismatch.
3. Continue through the suggested solutions.
4. Select Create a support request.

Creating a portal request requires the appropriate subscription support-request permission; a request without a subscription for an Entra scenario requires an administrator.^5^

If no portal session or authorized administrator can open a request, this is a tenant-lockout case. Contact Microsoft customer service by phone so tenant ownership can be verified and access to the existing tenant recovered.^6^ Do not ask for the personal Microsoft account to be deleted: the required action is recovery or reset of the tenant-side Entra MFA registration.

References

1. What's the difference between a Microsoft account and a work or school account? | Microsoft Support
2. Authentication methods in Microsoft Entra ID - Microsoft Authenticator app
3. Manage user authentication methods for Microsoft Entra multifactor authentication
4. Reset Personal Azure MFA - Microsoft Q&A
5. Create an Azure support request
6. Plan for tenant recoverability