Personal Azure account locked out after phone migration. Azure MFA still bound to old Authenticator device.

The required recovery depends on whether another administrator can access the Microsoft Entra tenant: that administrator can force MFA re-registration; otherwise, Microsoft Support must verify tenant ownership and recover administrator access.

The 8-digit code shown for the personal Microsoft account is not the 6-digit credential Azure is requesting for the tenant identity. Reconfiguring Authenticator for Outlook.com therefore does not necessarily repair the authentication methods stored on the corresponding Microsoft Entra user or guest object. A matching case was resolved by resetting MFA on the personal account’s guest object inside the tenant.^1^

If another tenant administrator exists

Ask an administrator with at least the Authentication Administrator role to:

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID → Users.
3. Select the affected Outlook.com user. Check both the sign-in address and any guest user object representing that account.
4. Open Authentication methods.
5. Select Require re-register MFA, then confirm.
6. Sign in to Azure again and register Authenticator on the new phone when prompted.

This operation removes the user’s existing Authenticator, phone, and software OATH methods so that new MFA registration is requested at the next sign-in.^2^

An administrator cannot normally perform this operation on their own user object, so it requires a different authorized account.^2^

If no other administrator can sign in

This is a tenant lockout. Since the self-service alternatives have already been exhausted, do not repeat the incognito, alternate portal, or personal-account MFA registration attempts.

Contact Microsoft Support by phone using the number for your country or region and request an escalation for:

Microsoft Entra tenant lockout — sole Global Administrator cannot satisfy MFA after changing phones; request tenant-ownership verification and administrator access recovery.

Microsoft’s documented process is to open a support case, perform high-assurance tenant-ownership verification, and help a designated Global Administrator regain access to the existing tenant.^3^ The official regional telephone list is available here.^4^

Have the following available for the private support case:

• The affected administrator sign-in address.
• Tenant’s initial onmicrosoft.com domain, if known.
• Azure subscription ID and billing evidence.
• The exact sign-in behavior: Azure requests six digits, Authenticator displays eight digits, and push approval does not arrive.
• Confirmation that no other Global Administrator can access the tenant.
• A reachable email address and telephone number.
• Any information Microsoft requests to establish identity and tenant ownership.

Do not post subscription, billing, identity, or tenant-verification details publicly in Q&A.

Microsoft Q&A moderators cannot directly reset accounts or alter MFA. Closely matching personal Outlook.com/Azure lockout cases with no other administrator were resolved by opening a support ticket and engaging the Data Protection team.^5^ A new Q&A post may help surface the case, but it is not itself the recovery mechanism; the actionable route is a Microsoft Support case.

After access is restored

1. Re-register Authenticator on the current phone.
2. Add another supported authentication method.
3. Create and secure an additional emergency administrative account so loss of one device does not produce another tenant-wide lockout. Microsoft specifically recommends emergency-access accounts as protection against administrator lockout.^6^

References

1. Reset Personal Azure MFA - Microsoft Q&A
2. Manage user authentication methods for Microsoft Entra multifactor authentication
3. Plan for tenant recoverability
4. Contact Microsoft customer support
5. Personal Outlook account not receiving MFA notifications when attempting to log into Azure - Microsoft Q&A
6. Require MFA for Azure management