In my Mobile phone, Teams to Authenticator is showing pattern lock verification.

Question

In my Mobile phone, Teams to Authenticator is showing pattern lock verification.

Sathish Kumar G 0

Teams to Authenticator, Multi-Factor verification is showing error. It is not allowing me to login in to my account, i want to disable it. This is the error message is showing "Message: AADSTS50000: There was an error issuing a token or an issue with our sign-in service". I'm facing this issue in the work mode.

0 comments

2 answers

Your answer

Answer 1

You generally cannot disable organization-required MFA yourself; ask your IT administrator to inspect the failed Entra sign-in and, if the registered Authenticator method is unusable, require MFA re-registration for your work account.

What the pattern-lock prompt means

Authenticator App Lock uses the device PIN, pattern, or biometric before opening the app or approving a notification. On Android Work Profile, the profile may have separate security settings, so personal-profile biometrics do not necessarily carry over.^1^

Verify, with IT assistance if needed, that a PIN or biometric is enabled for the Android work profile. Microsoft specifically requires this for Authenticator in Android for Work/Work Profile.^2^

Turning off Authenticator App Lock is different from disabling MFA. Your organization may require two-step verification, in which case you cannot turn it off yourself.^3^

Recover the account

On the verification screen, look for I can’t use my Microsoft Authenticator app right now, Sign in another way, or a similar option.
Use SMS, phone, or another method only if it was previously registered and is offered.
If no alternative works, contact your organization’s IT help desk or Microsoft 365 administrator.
Ask an appropriately privileged administrator—such as an Authentication Administrator for a regular user—to review your Entra sign-in event and then, if it shows the registered Authenticator method is the problem, perform:
- Microsoft Entra admin center → Entra ID → Users
- Select your account
- Select Authentication methods
- Select Require re-register MFA
- Optionally select Revoke sessions to force fresh authentication

Require re-register MFA removes the registered Authenticator apps, phone numbers, and software OATH methods. At the next sign-in, you will be prompted to register an allowed method again.^4^

Do not remove the Authenticator account from the phone before IT confirms the reset unless another working verification method is available; otherwise, recovery can become more difficult.

Check AADSTS50000 separately

AADSTS50000 is not specific to Authenticator or MFA. It can have multiple causes, including password synchronization or expiration, token-request configuration, application consent, and application signing-key issues.^5^

Ask the administrator to examine the failed event in Microsoft Entra admin center → Identity/Entra ID → Monitoring & health → Sign-in logs before changing tenant-wide MFA settings:

If the event indicates an MFA or authentication-method failure: use Require re-register MFA as described above.
If the work-account password is expired, invalid, or potentially out of sync in a hybrid Active Directory environment: reset the password, then verify that the new password authenticates successfully to Microsoft Entra ID.^5^
If the event points to consent, token-flow, or application configuration: the identity/application administrator must correct that issue; resetting Authenticator will not resolve it.

An administrator can also run the Teams Sign-in diagnostic from the Microsoft 365 admin center using the affected username. This diagnostic requires a Microsoft 365 administrator and is unavailable in certain government, 21Vianet, and Germany environments.^6^

If you are the only administrator

If this is your organization’s tenant and you are the only Global Administrator who is locked out, another user cannot reset your authentication method. Contact Microsoft business support and request tenant/account recovery after ownership verification.^7^

References

Answer 2

Hi @Sathish Kumar G

The AADSTS50000 message does not necessarily mean that MFA is malfunctioning. It means the work-account sign-in service could not issue a token. Documented causes include an expired or out-of-sync password, a revoked user session, or an authentication configuration issue.

For more details, please refer to: Microsoft Entra authentication & authorization error codes - Microsoft identity platform

Error AADSTS50000 - There Was an Error Issuing a Token or an Issue with Our Sign-In Service

Since this is a work account, MFA is managed by your organization and generally cannot be disabled by the user when enforced through an organizational policy. Please contact your IT administrator and ask them to reset your MFA registration and revoke your existing sign-in sessions.

They can follow these steps:

Sign in to the entra.microsoft.com as at least Authentication Administrator.
Select User -> All user. Select the user (your account) to act on and select Authentication methods. then select Require re-register of multi-factor authentication.

Require re-register MFA: This disables all previous authentication methods. You'll then be prompted to configure a new MFA authentication method the next time you try to sign in, so you can set up from the start and add a new authenticator app.

For more details, please refer to: Manage user authentication methods for Microsoft Entra multifactor authentication.

Note: Once re-registration is triggered, all your existing MFA methods such as phone numbers, Authenticator app, or other verification options will be removed. You will need to set up new MFA methods during your next login. Please ensure you have access to a valid phone number or the Microsoft Authenticator app before attempting to sign in again.

If you are the only Global Administrator for the organization, this issue cannot be resolved through the community forum, the next step would be to contact Microsoft Data Protection team directly for assistance as they have tools and processes in place to verify identity and regain access to administrator accounts.

Please note that I am just a fellow user contributing to this community forum and community members do not have access to your tenant or the ability to escalate the case to the Microsoft Data Protection Team on your behalf.

You can find the appropriate customer service phone numbers at this link: Customer service phone numbers.

(Choose Work account scroll down to Technical support phone numbers and find the Phone number of your country)

Please remember to provide them with your account details and explain the situation. Be ready to provide:

The company name used during subscription
Billing email address (even if it’s a personal Microsoft account)
Payment method details (last 4 digits of the card, billing address)
Any subscription ID or invoice numbers from billing email

When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.

To make the process smoother, here’s an example of how to respond when speaking to the automated system (IVR):

IVR: What kind of problem are you concerned about?

You: Authenticator.

IVR: What kind of product do you use?

You: Office 365 for business.

IVR: education or company account?

You: For companies

IVR: Are you an administrator?

You: Yes.

IVR: Do you have the other administrator in your organization?

You: No.

IVR: Do you need a... Service request?

You: Yes

These prompts help direct your call to the right support team more quickly, especially when dealing with account lockouts and authentication issues.

Hopefully it will help work with your issue and if you have any other questions or need further assistance, feel free to ask.