Azure Entra ID MFA lockout: Subscription Owner unable to access Azure portal despite disabling two-step verification

Alexandros Georgakakis 0 Reputation points
2026-10-30T18:17:51.92+00:00

Hello Microsoft Support Team,

I am requesting assistance with an ongoing Microsoft Entra ID authentication issue that has prevented me from accessing and administering my Azure environment.

The issue

I am the Owner of an Azure subscription associated with a Microsoft Entra tenant. Until recently, I was able to access and manage the environment normally.

However, I am now unable to complete the MFA authentication process when signing in through a desktop browser.

Specifically:

  • Microsoft Authenticator displays an 8-digit code, while the authentication screen requests a 6-digit verification code.

When I attempt alternative authentication methods involving Microsoft Authenticator approval or number matching, I do not receive the expected notification.

I have already disabled two-step verification on my personal Microsoft account, but the Azure/Entra authentication requirement remains active.

I still have an authenticated Azure session on my mobile device, but I cannot use it to resolve the authentication configuration or regain normal desktop access.

What I have already attempted

Verified the Microsoft Authenticator configuration and available authentication methods.

Attempted alternative MFA verification options.

Disabled two-step verification at the Microsoft account level, without resolving the Entra ID MFA requirement.

Investigated whether another administrator could restore my access.

Contacted Microsoft Support through another user who still has access to the environment.

Unfortunately, these attempts have not resolved the issue.

Administrative access

I am the subscription Owner. Another user has Contributor permissions, but we have not been able to use that access to reset or repair my authentication methods. Another previously configured administrative account is currently unavailable.

My Azure DevOps organization is managed separately and is not the authentication issue being reported here.

Existing Microsoft Support case

A support case has already been opened:

Case number: 26102000050004305

We have received correspondence from Microsoft Support, but the authentication problem remains unresolved.

Assistance requested

Could a Microsoft moderator or support engineer please help escalate this issue to the appropriate Microsoft Entra ID authentication or account recovery team?

I specifically need assistance with:

Reviewing the authentication methods registered against my Entra ID identity.

Determining why Microsoft Authenticator is presenting an incompatible verification code or failing to receive approval requests.

Resetting or re-registering my MFA methods through an authorized administrative or Microsoft-supported recovery process.

Restoring my ability to authenticate through the Azure portal without modifying or disrupting my subscription and existing resources.

I can provide the tenant ID, subscription details, screenshots, sign-in information, and evidence of ownership through a private Microsoft Support channel.

I would appreciate any assistance in getting this case assigned to the appropriate team, particularly since the usual troubleshooting and support routes have not resolved the lockout.

Thank you in advance for your assistance.Hello Microsoft Support Team,

I am requesting assistance with an ongoing Microsoft Entra ID authentication issue that has prevented me from accessing and administering my Azure environment.

The issue

I am the Owner of an Azure subscription associated with a Microsoft Entra tenant. Until recently, I was able to access and manage the environment normally.

However, I am now unable to complete the MFA authentication process when signing in through a desktop browser.

Specifically:

Microsoft Authenticator displays an 8-digit code, while the authentication screen requests a 6-digit verification code.

When I attempt alternative authentication methods involving Microsoft Authenticator approval or number matching, I do not receive the expected notification.

I have already disabled two-step verification on my personal Microsoft account, but the Azure/Entra authentication requirement remains active.

I still have an authenticated Azure session on my mobile device, but I cannot use it to resolve the authentication configuration or regain normal desktop access.

What I have already attempted

Verified the Microsoft Authenticator configuration and available authentication methods.

Attempted alternative MFA verification options.

Disabled two-step verification at the Microsoft account level, without resolving the Entra ID MFA requirement.

Investigated whether another administrator could restore my access.

Contacted Microsoft Support through another user who still has access to the environment.

Unfortunately, these attempts have not resolved the issue.

Administrative access

I am the subscription Owner. Another user has Contributor permissions, but we have not been able to use that access to reset or repair my authentication methods. Another previously configured administrative account is currently unavailable.

My Azure DevOps organization is managed separately and is not the authentication issue being reported here.

Existing Microsoft Support case

A support case has already been opened:

Case number: 26102000050004305

We have received correspondence from Microsoft Support, but the authentication problem remains unresolved.

Assistance requested

Could a Microsoft moderator or support engineer please help escalate this issue to the appropriate Microsoft Entra ID authentication or account recovery team?

I specifically need assistance with:

Reviewing the authentication methods registered against my Entra ID identity.

Determining why Microsoft Authenticator is presenting an incompatible verification code or failing to receive approval requests.

Resetting or re-registering my MFA methods through an authorized administrative or Microsoft-supported recovery process.

Restoring my ability to authenticate through the Azure portal without modifying or disrupting my subscription and existing resources.

I can provide the tenant ID, subscription details, screenshots, sign-in information, and evidence of ownership through a private Microsoft Support channel.

I would appreciate any assistance in getting this case assigned to the appropriate team, particularly since the usual troubleshooting and support routes have not resolved the lockout.

Thank you in advance for your assistance.

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-10-30T18:19:08.66+00:00

    Request reassignment of the existing support case to the Microsoft Entra tenant-access recovery/Data Protection team, because an Azure subscription Owner or Contributor cannot reset Entra authentication methods unless that identity also holds the required Microsoft Entra administrative role.

    What to request in the existing case

    Reply through the case’s private support channel with wording such as:

    This is a Microsoft Entra tenant-access lockout involving an unusable MFA registration. Please route the case to the team responsible for Microsoft Entra tenant-access recovery/Data Protection and high-assurance tenant ownership verification.

    The affected identity cannot complete MFA: the sign-in page requests a six-digit verification code, Authenticator displays an incompatible eight-digit code, and push/number-matching requests are not received. No currently accessible Entra administrator can reset the authentication methods.

    Please verify tenant ownership and recover access to the existing tenant by resetting or enabling re-registration of the affected identity’s Entra authentication methods. No subscription or resource migration is requested.

    Attach or provide privately when requested:

    • Tenant primary domain and tenant ID
    • Affected sign-in name
    • Subscription and billing verification
    • Sign-in timestamp, request ID, correlation ID, and error text
    • Screenshots showing the six-digit prompt and eight-digit Authenticator entry
    • Whether the affected identity is also a Global Administrator
    • Which Entra roles, if any, are held by the remaining accessible user
    • Whether Authenticator was moved to a new phone or the account username/UPN changed

    Microsoft’s documented lockout process is to open a support case; if portal access is unavailable, use Microsoft customer service by phone. Microsoft then performs high-assurance ownership verification and helps designated Global Administrators regain access to the existing tenant rather than creating a replacement tenant.^1^ Regional numbers are listed on the Microsoft support page.^2^

    A Microsoft Q&A moderator or community member cannot inspect or modify the account. A closely matching administrator-lockout case was resolved by engaging the Data Protection team through a support ticket.^3^

    Why the Contributor cannot perform the reset

    Azure RBAC and Microsoft Entra directory roles are separate:

    • Owner/Contributor govern Azure subscription resources.
    • Global Administrator, Authentication Administrator, or Privileged Authentication Administrator govern relevant identity operations.

    An Azure Owner is not automatically authorized to administer Entra authentication methods, and a Contributor cannot promote itself to an Entra role. Microsoft documents this distinction between subscription Owner and Global Administrator.^4^

    For privileged users, Privileged Authentication Administrator can manage authentication methods for all users; Authentication Administrator has a narrower scope.^5^

    If an authorized Entra administrator becomes available

    That administrator can perform the supported reset:

    1. Open Microsoft Entra admin center.
    2. Go to Entra ID → Users.
    3. Select the affected user.
    4. Select Authentication methods.
    5. Choose Require re-register MFA.
    6. After re-registration, use Revoke sessions if the old sessions should be invalidated.

    “Require re-register MFA” removes the registered phone numbers, Authenticator apps, and software OATH tokens, then prompts the user to configure MFA again at the next sign-in.^6^

    Do not delete the Authenticator entry from the phone before support or an authorized administrator confirms the server-side reset; doing so does not itself remove the Entra registration and could remove the only remaining local evidence or usable method.

    Interpreting the code mismatch

    Push number matching and verification-code entry are different flows:

    • For number matching, the browser displays a number that is entered or selected in the Authenticator approval request.
    • For an OATH verification code, Authenticator generates a time-based code that is typed into the sign-in page.^7^

    An eight-digit value should not be submitted to a prompt explicitly requesting a six-digit verification code. This symptom is consistent with the displayed Authenticator item not matching the Entra MFA registration expected by that sign-in.^8^

    Disabling two-step verification for a personal Microsoft account does not administer the authentication methods or policies of a separate Microsoft Entra work/school identity. The required action is therefore an Entra-side MFA re-registration or the tenant-recovery process—not another change to the personal account.

    After access is restored, configure at least two suitably protected Global Administrator/emergency-access accounts with distinct authentication methods to reduce the risk of another tenant-wide lockout.^9^

    References

    1. Plan for tenant recoverability
    2. Contact Microsoft customer support
    3. Sole Global Admin locked out of Entra ID tenant — Authenticator MFA loop / tenant lockout - Microsoft Q&A
    4. Frequently asked questions about Microsoft Entra ID
    5. Microsoft Entra built-in roles
    6. Manage user authentication methods for Microsoft Entra multifactor authentication
    7. Authentication methods in Microsoft Entra ID - Microsoft Authenticator app
    8. Authenticator generates 8 digits and Azure requires 6 digits
    9. Preventing tenant lockouts
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.