Stuck in a 2FA loop with Outlook and Microsoft Authenticator on my work email

Your organization’s IT administrator must issue a Temporary Access Pass (TAP), or reset your MFA registration and provide another bootstrap method, because you cannot bypass work-account MFA from Outlook or Authenticator.

Ask your IT help desk for this exact action

Send them this request:

My work account has no usable MFA method. Outlook and Microsoft Authenticator both require approval from Authenticator, and the verification-code option is inaccessible. Please issue a Temporary Access Pass so I can register Authenticator again, and remove or require re-registration of my unusable Authenticator method.

A TAP is a time-limited code intended for account recovery and registering a replacement authentication method when the existing strong-authentication method is unavailable.^1^

If TAP is enabled for your organization, an Authentication Administrator can:

1. Open Microsoft Entra admin center.
2. Go to Entra ID → Users → your account → Authentication methods.
3. Select Add authentication method → Temporary Access Pass.
4. Set its activation time and duration, then select Add.
5. Give you the displayed TAP securely. The value cannot be viewed again after the administrator closes that screen.^1^

Re-register Authenticator using the TAP

After receiving the TAP:

1. Open the Security info page in a private/incognito browser window.
2. Enter your work email address.
3. Choose the Temporary Access Pass sign-in option if it is not selected automatically.
4. Enter the TAP supplied by IT.
5. Add Microsoft Authenticator as a sign-in method.
6. In Authenticator, choose Add account → Work or school account → Scan QR code, then scan the QR code displayed in the browser.
7. Complete the test approval.
8. Remove the obsolete Authenticator registration if it remains listed, and add another method permitted by your organization as a backup.

TAP does not replace your password; it supplies the strong authentication needed to register a working method.^1^

If your organization does not use TAP

An Authentication Administrator can instead open:

Microsoft Entra admin center → Entra ID → Users → your account → Authentication methods

They can then select Require re-register MFA. This deletes registered phone numbers, Authenticator registrations, and software OATH methods, prompting fresh MFA setup at the next applicable sign-in. They can also select Revoke sessions to force applications to authenticate again.^2^

However, resetting the methods alone may not be sufficient if your organization requires MFA before security-information registration. IT must also give you an allowed way to bootstrap the new registration—preferably TAP—or add another permitted authentication method. Microsoft’s deployment guidance specifically recommends TAP when a user has no backup method.^3^

Do not uninstall Authenticator first. Work or school account credentials are not restored from Authenticator backup; only the account name is restored, after which the account must be registered again.^4^

If no other verification method is already registered, the consumer Microsoft-account recovery form is not the appropriate route for this company-managed account; the organization’s Entra administrator controls its MFA methods.

References

1. Configure Temporary Access Pass to register passwordless authentication methods
2. Manage user authentication methods for Microsoft Entra multifactor authentication
3. Plan a Microsoft Entra multifactor authentication deployment
4. [Android](https://support.microsoft.com/authenticator/restore-account-credentials-from-microsoft-authenticator#what-information-is-restored-in-authenticator)