i forgot my fido2 pin and i cannot access some parts of my account

Ask your organization’s IT administrator to revoke your Microsoft Entra sessions and, if your password does not complete sign-in, issue a Temporary Access Pass (TAP) so you can replace the forgotten security-key credential.

1. Sign in without the security key, if possible

On the Microsoft sign-in page:

1. Select Sign-in options or Sign in another way.
2. Choose your password plus any other registered method, such as Microsoft Authenticator, SMS, or another security key.
3. After signing in, open Security info.
4. Remove the inaccessible FIDO2 security key. Microsoft documents removal through the Security info page.^1^
5. Register another authentication method before signing out. Ideally, maintain at least two methods.

The FIDO2 PIN is stored with and protects the physical USB/NFC key. It is separate from your Microsoft Entra password and from a Windows Hello PIN.

2. Have IT revoke all active sessions

If your goal is to sign the account out everywhere, ask an Authentication Administrator to:

1. Open the Microsoft Entra admin center.
2. Go to Entra ID → Users.
3. Select your account → Authentication methods.
4. Select Revoke sessions.

This invalidates your refresh tokens and forces reauthentication across active applications.^2^

Revocation might not terminate every session instantly. Access-token sessions can continue until their token expires, while sessions controlled directly by an application depend on that application’s own revocation behavior.^3^

If you cannot pass MFA using another method, the administrator should issue a Temporary Access Pass rather than deleting all authentication methods. TAP is the recommended way to provide temporary sign-in access so you can register a replacement method.^4^

3. Reset the physical key only if you want to reuse it

A forgotten security-key PIN generally requires resetting the physical key to factory defaults.

Warning: Resetting the key permanently deletes every account credential stored on that key—not only this Microsoft account.^5^

On Windows:

1. Open Settings → Accounts → Sign-in options.
2. Select Security Key → Manage.
3. Insert the USB key or tap the NFC key.
4. Follow the manufacturer-specific instructions to reset it.
5. Return to Security Key → Manage and create a new security-key PIN.
6. Sign in using TAP or another method, open Security info, and register the reset key again.

Do not use PIN (Windows Hello) → I forgot my PIN for this problem; that resets the device’s Windows Hello PIN, not the PIN on the physical FIDO2 key.

If this is the tenant’s only administrator account and no alternate admin or emergency-access account is available, open a Microsoft support request for tenant-access recovery.^6^

References

1. Deployment frequently asked questions (FAQs) for hybrid FIDO2 security keys in Microsoft Entra ID
2. Manage user authentication methods for Microsoft Entra multifactor authentication
3. Revoke user access in Microsoft Entra ID
4. Reset-EntraStrongAuthenticationMethodByUpn-Syntax
5. Set up a security key as your verification method | Microsoft Support
6. How can I regain access to my account after losing access to Microsoft Authenticator? - Microsoft Q&A