A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation
Stop all sign-in and recovery attempts long enough for the temporary verification block to clear, then use the 25-digit recovery code through its dedicated “I don’t have any of these” route—not in the Authenticator-code field.
1. Allow the verification block to clear
Because SMS, Authenticator, and the recovery code all fail after one or two attempts—and SMS then becomes unavailable—the current behavior is consistent with a verification-request block. Microsoft advises:
- Make no sign-in, password-reset, SMS-code, Authenticator-code, or recovery-code attempts for at least 24 hours.
- If the block remains after 24 hours, continue waiting without testing repeatedly—Microsoft says the wait may need to be up to one week.
- For the next attempt, use a familiar device and location, but switch between Wi-Fi and cellular data if the same server error recurs.
Repeated attempts can restart the time lock, while switching verification method or network may bypass a method-specific block.^1^
2. Enter the recovery code through the correct route
After the uninterrupted cooldown:
- Start signing in to the personal Microsoft account.
- Select Other ways to sign in.
- Select Use my password.
- Select Forgot password?
- Select Use a different verification option.
- Select I don’t have any of these.
- At Do you have an account recovery code?, enter the 25-digit code.
- Entering a valid code should offer the option to update the password.
Spaces, dashes, and capitalization do not matter. Only the latest recovery code is valid; generating a newer code invalidates every earlier one.^2^
This route is materially different from entering the recovery code where the reset flow requests the six-digit Authenticator code. A recovery code is not an Authenticator one-time code.
Because two-step verification is enabled, Microsoft notes that changes made through this recovery route can take 30 days to become effective.^2^
3. If the six-digit Authenticator code is still requested
Before making the single post-cooldown attempt:
- Set the phone’s date, time, and time zone to automatic, then restart it. Time-based Authenticator codes depend on an accurate device clock.
- Update Microsoft Authenticator and the phone operating system.
- Disconnect any VPN.
- Switch between Wi-Fi and cellular data.
- Confirm that the account shown above the rotating code is the personal Microsoft account being recovered.
Microsoft specifically documents automatic device time, current app/device versions, network changes, and disabling VPN as Authenticator troubleshooting steps.^3^
Do not remove the account from Authenticator or reinstall the app while locked out. Doing so could remove the only currently registered Authenticator credential, with no ability to re-register it until account access is restored.
4. If the dedicated recovery-code route still fails
Run the Microsoft account Sign-in Helper after the cooldown and report that:
- this is a personal Microsoft account;
- SMS verification succeeds initially;
- the second factor returns the temporary server error;
- the same error occurs through the dedicated 25-digit recovery-code route;
- further attempts trigger another block.
The Sign-in Helper is Microsoft’s designated tool for personal-account sign-in problems and directs users to the available recovery or support path.^4^
Do not rely on the standard account recovery questionnaire as a substitute for the missing second factor. Microsoft states that when two-step verification is enabled and none of the alternate verification methods can be accessed, support agents cannot send a reset link or change the account’s security details.^5^ Support can investigate the recurring service/block condition, but cannot manually bypass MFA.
You have already submitted Authenticator logs through Send Feedback, so repeating that step is unlikely to move recovery forward. Preserve any feedback case/reference ID and provide it when the Sign-in Helper offers a support contact path.
References