login issues

Your organization’s Microsoft 365 administrator must review the sign-in block, remove the unfamiliar iPad authentication registration, revoke existing sessions, and require you to register MFA again on your iPhone.

What to do now

• Contact your workplace IT help desk or Microsoft 365 administrator.
• Tell them the message says your sign-in is blocked by your organization/facility and that an unknown iPad appears under Security info.
• Do not approve unexpected Authenticator notifications.
• A wrong password alone is not established as the cause; an organizational block cannot be cleared from the Authenticator app.

Actions for your administrator

An administrator with at least the appropriate User/Authentication Administrator permissions should:

1. Open Microsoft Entra admin center → Entra ID → Users → select your account → Profile.
2. Under Settings, check Block sign in.
   • If it is Yes, investigate why the account was blocked.
   • Set it to No only after confirming that restoring access complies with the organization’s security policy. ^1^
3. Open Authentication methods for your account and review the registered methods.
4. Remove the unknown iPad/Authenticator registration.
5. Select Revoke sessions to invalidate existing refresh tokens and force reauthentication on signed-in applications.
6. Select Require re-register MFA. This removes the registered Authenticator apps, phone numbers, and software OATH tokens, so they must be configured again at the next sign-in. ^2^
7. If unauthorized activity is suspected, reset the password and follow the organization’s compromised-account process before unblocking access.

Requiring MFA re-registration removes all existing Authenticator registrations, including legitimate ones, so your iPhone will need to be enrolled again.

Register your iPhone again

After the administrator completes those actions:

1. Open a browser and sign in to https://login.microsoftonline.com.
2. Use the temporary/new password if the administrator reset it.
3. Follow the prompt to configure Microsoft Authenticator.
4. On your iPhone, open Authenticator and add Work or school account.
5. Scan the QR code displayed in the browser and complete the test approval.
6. Return to Security info and confirm that only methods and devices you recognize are present.
7. Add another verification method if your organization permits it, so loss of Authenticator does not lock you out again.

If your organization offers account recovery

At sign-in, select Other ways to sign in. If Recover your account appears, your organization has enabled self-service account recovery. Complete its identity-verification process; it can issue a Temporary Access Pass that lets you register a new authentication method. This option appears only for users included in the organization’s configured recovery scope. ^3^

If you are the organization’s only administrator and no recovery method works, this is an administrator lockout; Microsoft Support must perform tenant/account recovery after ownership verification. ^4^

References

1. Problems signing in to a Microsoft application
2. Manage user authentication methods for Microsoft Entra multifactor authentication
3. Perform account recovery in Microsoft Entra ID
4. log in issue - Microsoft Q&A