MFA authentication loop

Microsoft Q&A moderators and Microsoft Support cannot manually reset MFA or change the security information for a personal Microsoft account; recovery depends on whether two-step verification was enabled.

If two-step verification was enabled

If none of the methods under Sign in another way are accessible, the account cannot be recovered through the recovery form. Microsoft states that support agents cannot send reset links or change account details in this situation, because they cannot bypass two-step verification.^1^

Check first for any authentication method you may still possess:

• A recovery email account
• A passkey saved on a device
• A previously configured security key
• Microsoft Authenticator on another device
• A device or browser where the account remains signed in

If an existing session still lets you open the Microsoft account Security page, add a new verification method before removing the deleted Authenticator registration:

1. Open Security.
2. Select Manage how I sign in.
3. Select Add a new way to sign in or verify.
4. Add an accessible email address, Authenticator registration, or passkey and complete its verification.^2^

If two-step verification was not enabled

Use Microsoft’s Sign-in Helper first. If it directs you to the account recovery form:

1. Supply a separate working email address for Microsoft’s response.
2. Complete the form from a device and location previously used with the account.
3. Include as much account-specific information as possible, such as:
   • Previous passwords
   • Exact Outlook.com email subject lines and contacts
   • Skype details
   • The hardware ID of a frequently used Xbox console
4. Microsoft normally sends the result to the working email address within 24 hours. An unsuccessful request can be retried up to twice per day.^1^

If “I don’t have any of these” appears

Select it and follow the prompts to replace the unavailable security information. Replacing all security information puts the account into a restricted state for 30 days; further security or billing changes cannot be made during that period.^3^

After access is restored, register Authenticator again and add at least one independent backup method before removing any old method.

References

1. Help with the Microsoft account recovery form | Microsoft Support
2. Microsoft account security info & verification codes | Microsoft Support
3. Removing a sign-in verification method | Microsoft Support