Fix Azure MFA 5-Device Limit: How to Remove Obsolete Devices
Question details
A user is unable to register a new phone for Azure MFA because their account has reached the maximum five-device limit, and attempting to delete old devices via the standard security portal fails with an error.
- Product
- Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Attempting to register a new device for two-step verification after maxing out the allowed MFA device entries.
- Observed behavior
- Deleting old devices from the user security information page fails with an error requiring Microsoft Authenticator. Resetting MFA and clearing per-user entries does not resolve the persistent device list.
Ensure you have the required Microsoft Entra ID (formerly Azure AD) administrator permissions, as users cannot bypass this error themselves without administrator intervention.
Remove Stale Devices via the Administrator Assigned Applications View
Use the hidden administrator page for the user's assigned applications to manually clear out obsolete device records and free up MFA slots.
The standard user-facing security portal often blocks device deletion if it requires confirmation from an Authenticator app that the user no longer possesses. Resetting MFA settings in the standard portal does not always clear the physical device records. An administrator must delete them from the dedicated registered entries screen.
Sign in to the Microsoft Entra admin center or Azure portal using an account with Global Administrator or Authentication Administrator privileges.
Navigate to 'Users' > 'All users' and select the specific user experiencing the five-device limit issue.
Access the administrator view for the user's assigned applications and registered authentication entries. This hidden page bypasses the standard user security information restrictions.
Identify the stale devices in the list of five entries and click the 'Delete' option next to each obsolete phone or authentication method.
Instruct the user to sign in to their Microsoft 365 account again and follow the prompts to register their new device for MFA.
Manage Devices via Security Info (If Accessible)
If the user still has access to at least one working authentication method, they might be able to manage their devices directly.
Need a Reliable and Hassle-Free Alternative to Microsoft Office? Try WPS Office
While managing complex enterprise IT tasks like Azure MFA limits requires Microsoft's administrative tools, your daily document productivity doesn't have to be complicated. WPS Office provides a lightweight, entirely free alternative to Microsoft Office, offering full compatibility with Word, Excel, and PowerPoint without the heavy account management overhead.
- 1. Visit the WPS Website: Navigate to the official WPS Office website on your device.
- 2. Download the Free Version: Click the 'Free Download' button to get the lightweight installer.
- 3. Install and Start Creating: Run the setup file and start editing your documents with full Microsoft Office compatibility.
Frequently Asked Questions
Why does deleting an MFA device fail with a red error?
The deletion often fails because Microsoft's security policy requires verification from the Authenticator app on the exact device you are attempting to remove. If that device is lost or wiped, you cannot authenticate the deletion, requiring an administrator to force-remove it.
What is the maximum number of devices I can register for Azure MFA?
Microsoft enforces a default limit of five registered devices or authentication methods per user for Azure Multi-Factor Authentication.
Does resetting the user's MFA settings clear the device list?
No. Simply resetting MFA or disabling it often does not clear the physical device registrations. Administrators must manually delete the stale device entries from the assigned applications or registered entries page.
