Microsoft 365 features that help users manage their subscriptions, account settings, and billing information.
To use Microsoft Authenticator on the new phone when the old phone is unavailable and there are no backup methods configured, the MFA methods must be reset by an administrator or Microsoft support.
Use the appropriate path based on the type of account:
- If this is a work or school (Microsoft Entra / Microsoft 365 business) account and there is an IT/admin team:
- Contact the organization’s Microsoft 365/Entra administrator.
- Ask them to reset MFA for the account by requiring re-registration of multifactor authentication in the Microsoft Entra admin center (Users → the user → Authentication methods → “Require re-register multifactor authentication”).
- After the reset, sign in again; the sign-in flow will prompt to set up Microsoft Authenticator on the new phone.
- If this is a work or school account and there is no alternative MFA method and no admin available (or the user is the only global admin):
- A Microsoft support engineer (Data Protection team) must verify identity and reset the MFA methods.
- Call Microsoft using the regional number listed under Customer service phone numbers and clearly state:
- This is an Office 365/Microsoft 365 for business account.
- It is a company account (not personal).
- The caller is the only administrator and is locked out due to Microsoft Authenticator on a lost/broken phone.
- A Data Protection team case is needed to reset MFA for the tenant admin account.
- If reaching a live agent is difficult, create a temporary trial Microsoft 365 tenant, sign in to its admin center, and open a support ticket from there requesting Data Protection help for the original tenant (include tenant domain, admin UPN, and error details). This temporary tenant is only for contacting support and does not give access to the original data.
- If this is a regular user (non-admin) in a business tenant with no backup methods:
- Contact the organization’s help desk or IT support.
- Ask them to clear or reset MFA settings for the account so that registration can be done again on the new phone.
- For future prevention once access is restored:
- Add at least one backup MFA method (phone call, SMS, or another app) on the Security info / Additional security verification page so that a single lost phone does not cause lockout.
- Consider enabling password reset methods (email, phone, security questions if allowed) so that account recovery is easier.
If repeated sign-in attempts have already been made and sign-in is now blocked, wait before trying again or use a different MFA method if one exists. If malicious activity is suspected, the IT administrator should review Microsoft Entra sign-in logs.
References:
- Use a screen reader to set up and troubleshoot multifactor authentication
- Common problems with two-step verification for a work or school account
- Set up a phone call as your verification method
- Microsoft authenticator sending me into a spiral - Microsoft Q&A
- I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
- I need to reset my mfa methods - Microsoft Q&A
- Requesting a Tenant Admin MFA Reset - Microsoft Q&A
- Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A