Unable to Access School Microsoft 365 Account After Removing Microsoft Authenticator

An Authentication Administrator for the Egyptian Ministry of Education tenant must require MFA re-registration for the affected account; removing the account from the phone does not remove its existing registration from Microsoft Entra ID.

Required administrator action

Contact the Ministry of Education’s central Microsoft 365/identity-management team—not merely the local school or portal support team—and request:

“Please require re-registration of MFA for my work or school account because the registered Microsoft Authenticator method is no longer available.”

An administrator with at least the Authentication Administrator role should:

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID → Users.
3. Select the affected user.
4. Select Authentication methods.
5. Select Require re-register MFA.
6. Confirm the action.

This removes the account’s registered Microsoft Authenticator apps, phone numbers, software OATH tokens, and deactivates hardware OATH tokens. At the next sign-in, Microsoft prompts the user to register a new MFA method.^1^

After the reset:

1. Start a fresh sign-in.
2. When prompted to configure security information, choose Microsoft Authenticator.
3. In Authenticator, select Add account → Work or school account → Scan QR code.
4. Scan the newly displayed QR code and complete the test approval.

Do not keep trying the old notification or verification-code options: both refer to the deleted app registration, and no usable alternative method is currently available.

Alternative: Temporary Access Pass

If the Ministry has enabled Temporary Access Pass (TAP), its administrator can issue a time-limited passcode that lets you register Authenticator without using the unavailable MFA method. TAP is specifically supported for recovery when a user loses a strong authentication method.^2^

The administrator creates it under:

1. Entra ID → Users → affected user → Authentication methods.
2. Select Add authentication method.
3. Select Temporary Access Pass, configure its activation and duration, and select Add.
4. Provide the displayed TAP securely; its value cannot be viewed again after the administrator closes the dialog.

You then open Authenticator and select:

1. Add account → Work or school account.
2. Sign in.
3. Enter the account name and the TAP when requested.
4. Complete Authenticator registration.

TAP is available only if the tenant’s Authentication Methods policy includes your account. Enabling that policy requires an Authentication Policy Administrator, while creating a TAP for a regular member account requires at least an Authentication Administrator.^2^

Who must handle the request

This is an organization-managed school account, so a local Microsoft community moderator cannot change its authentication methods. The reset normally must be performed by the Ministry tenant’s Microsoft 365/Entra identity administrator. A closely matching school-account case likewise directs the user to request “Reset my MFA settings or allow me to re-register for MFA.”^3^

When contacting the Ministry help desk, provide:

• The affected username, through its secure support channel.
• The exact Authenticator error.
• Confirmation that the Authenticator account was removed.
• Confirmation that Sign in another way offers no usable method.
• The requested action: Require re-register MFA, or issue a Temporary Access Pass if permitted.

Do not post the full account address, password, QR code, TAP, or verification codes publicly.

If this is the tenant’s only accessible administrator

If another Global Administrator or Authentication Administrator can sign in, that person should perform the reset. If all tenant administrators are locked out, the tenant owner’s Global Administrator must contact Microsoft Support for tenant recovery; if the organization has a Microsoft partner with suitable delegated administrative privileges, that partner may be able to restore access or open the service request.^4^

Microsoft publishes its current business-support contact routes and regional numbers, including Egypt, on the customer-support page.^5^ Support will need to validate the tenant and authorized administrator; it is not an alternative method for bypassing identity verification.

After recovery, register more than one permitted MFA method so the loss of one device does not create another lockout. Microsoft’s recovery guidance recommends a TAP or administrator-managed method update when no backup method is available.^6^

References

1. Manage user authentication methods for Microsoft Entra multifactor authentication
2. Configure Temporary Access Pass to register passwordless authentication methods
3. I Can't Verify My Identity on Microsoft Authenticator App - Microsoft Q&A
4. Preventing tenant lockouts
5. Contact Microsoft customer support
6. Plan a Microsoft Entra multifactor authentication deployment