A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation
Error 500121 means the multifactor authentication (MFA) prompt was not completed, so first open and unlock Microsoft Authenticator directly to expose the pending number-matching request.^1^
Try the pending Authenticator request
- Keep the browser sign-in page open with the displayed number.
- On the phone, open Microsoft Authenticator manually and unlock it.
- Look for the pending request under your work or school account, then enter the number displayed in the browser.
- If the request is absent:
- Swipe down in Authenticator to refresh it.
- Confirm Authenticator notifications are enabled.
- Switch between Wi-Fi and mobile data.
- Confirm the phone’s date and time are correct.
- Update Authenticator from the device’s app store.
An app lock, disabled notifications, an outdated app, network problems, or incorrect device time can prevent the entry box from appearing.^2^
If another Microsoft 365 session is still signed in
Use that existing session to reconfigure Authenticator:
- Open https://mysignins.microsoft.com/security-info.
- Under Security info, remove the existing Microsoft Authenticator method.
- Select Add sign-in method and configure Microsoft Authenticator again.
- Complete a test sign-in before closing the working session.
This recovery path applies only if the page opens without requiring the Authenticator method that is currently failing.^3^
If you remain locked out
Select Sign in another way or I can’t use my Microsoft Authenticator app right now on the sign-in page. Use SMS, phone call, or another method only if your organization previously enabled and registered it.
If no alternative works, contact your organization’s IT help desk. Give them the error code, timestamp, request ID, and correlation ID from the failed sign-in and ask them to inspect the failure and provide an approved recovery method. If necessary, they can require MFA re-registration:
- Sign in to the Microsoft Entra admin center as at least an Authentication Administrator.
- Go to Entra ID → Users.
- Select your account, then Authentication methods.
- Select Require re-register MFA.
- Afterward, sign in again and register Authenticator from the beginning.
Important: Requiring re-registration removes the account’s registered phone numbers, Authenticator apps, and software OATH tokens, so those methods must be configured again.^4^
The administrator can also locate the exact event under Entra ID → Monitoring & health → Sign-in logs, filter for failed sign-ins, and match the timestamp or correlation ID. Access to these logs requires at least the Reports Reader role.^1^
References