IPhone - Entering numbers in Authenticator app just spins. Entering numbers in popup is successful.

For affected iPhone users, complete the request by tapping the Authenticator notification rather than opening Authenticator manually; on iOS browser sign-ins, Microsoft documents tapping the notification as the supported path for entering the number and approving the request.^1^

What the logs indicate

The failed and successful records appear to be two different outcomes of the same MFA transaction:

• Failed: Password succeeds, but the Authenticator response does not complete. Error 500121 means the user did not complete the MFA prompt; Microsoft notes that this can represent an incomplete prompt, timeout, or incomplete MFA setup.^2^
• Successful: The notification transaction completes as Mobile app notification, and the GPS location is returned.
• The blank second-method row is consistent with an MFA transaction that never returned a completed authentication method. It does not establish a password, MDM, or network failure.
• The missing GPS result on failed attempts is likely part of the incomplete Authenticator transaction—not proof that the geo-restriction policy initiated the failure. Entra obtains GPS coordinates from Authenticator, and a location-based policy can block access when the required location is not shared.^3^

Because the issue reproduces on a new iPhone, on Wi-Fi and cellular, without VPN, those checks do not need to be repeated.

Capture evidence before changing registration

Since two users are affected in GCC High, first preserve diagnostics for a likely client/service transaction issue:

1. Reproduce once by opening Authenticator manually and entering the number.
2. Immediately open Authenticator → top-level menu → Send feedback → Having trouble?
3. Submit the logs and record the generated incident ID.^4^
4. Record the corresponding Entra timestamp, request ID, correlation ID, error code, application, and Conditional Access results.
5. Repeat for the successful notification-path attempt so Support can compare both transactions.

Also install any available Authenticator update from the App Store. Microsoft does not support Authenticator versions more than 12 months old, and recommends sending diagnostic logs when work/school-account problems persist.^5^

Verify the GPS policy without weakening it

For one failed and one successful event, compare:

• Conditional Access → Policy name and result
• Location → Authenticator app location
• Named locations → United States (GPS) and United States (IP)
• Authentication Details → method, result, and result detail

On the iPhone, check Settings → Privacy & Security → Location Services → Authenticator and ensure the app can provide location, including background access if required by your organizational policy. GPS-based named locations require the user initially to open Authenticator and grant location permission; location can then be shared silently for the next 24 hours, after which another approval is required.^3^

Do not disable the geo-restriction policy as the first remedy. The successful transaction already demonstrates that the same user and device can return both GPS and IP location.

Conditional fallback: re-register Authenticator

If the problem remains limited to particular user registrations and no GCC High service incident is identified, reset one test user before doing this for both. Require re-register MFA deletes that user’s Authenticator, phone, and software OATH methods, so arrange a usable bootstrap or alternate method first.

1. Sign in to the Microsoft Entra admin center as at least Authentication Administrator.
2. Go to Entra ID → Users → affected user → Authentication methods.
3. Select Require re-register MFA.
4. Have the user register Authenticator again and test both the notification and manually opened-app paths.^6^

Given that multiple users developed the same symptom recently, avoid treating re-registration as the primary fix unless a test user confirms it resolves the issue.

GCC High escalation

Check your tenant’s Microsoft 365 Service health for an Authenticator or Microsoft Entra incident. Service incident notices are delivered to affected administrators through the Microsoft 365 admin center.^7^

If no incident appears, a GCC High administrator should open:

Microsoft 365 Admin Portal → Show all → Support → New Service Request

Include both Authenticator incident IDs, paired failed/successful correlation IDs and timestamps, iOS and Authenticator versions, and the observation that notification entry succeeds while manual in-app entry stalls. GCC High support requests must be opened by an account with an eligible administrator role and valid email address.^8^

References

1. How number matching works in MFA push notifications for Authenticator ...
2. How to troubleshoot Microsoft Entra sign-in errors
3. Conditional Access: Network assignment
4. Send Microsoft Authenticator logs and get an incident ID
5. Troubleshoot problems with Microsoft Authenticator | Microsoft Support
6. Manage user authentication methods for Microsoft Entra multifactor authentication
7. Service health and continuity
8. How to open Support cases for GCC High and DoD