MFA failures generally fall into three categories: the second factor isn’t arriving, the registered method is no longer available (lost phone), or a policy is blocking sign-in entirely — each has a distinct fix.
Common Symptoms
- Verification code never arrives by SMS or call
- “You can’t sign in because your organization requires multi-factor authentication and your device isn’t enrolled”
- Locked out after losing the phone with the registered Authenticator app
Possible Causes
- Registered phone number or app no longer accessible
- Carrier SMS delays or blocks
- No backup verification method configured
- A device compliance policy in addition to plain MFA
Before You Begin
Check whether you have a backup MFA method registered (a second phone number, or the Authenticator app on a second device) before assuming you’re fully locked out.
Method 1 — Try an alternative verification method
Method 2 — Contact your administrator for a reset
Request MFA re-registration
If the registered device/phone is genuinely lost, only an administrator can reset your MFA registration from the Microsoft 365 admin center.
Method 3 — Register a backup method proactively
Add a second method
Once signed in successfully, go to Security info in your Microsoft account and add a second verification method so a single lost device doesn’t lock you out again.
Never share an MFA code with anyone who contacts you asking for it, even if they claim to be IT support — legitimate support staff never need your one-time code.
Frequently Asked Questions
What if I lose my phone with Authenticator installed?
Contact your Microsoft 365 administrator immediately — they can reset your MFA registration so you can re-enroll a new device, and can also review sign-in activity for anything suspicious.
Why does SMS-based MFA sometimes not arrive?
Carrier-side delays, being in an area with weak signal, or an SMS filtering app on the phone can all delay or block the code — app-based push notifications are generally more reliable.
Conclusion
Registering more than one MFA method in advance prevents most lockout scenarios — if you’re already locked out, an administrator-side reset is the fastest path back in.
Related Articles
