Fix Cannot Set Up Microsoft Authenticator After Losing Phone
Question details
The user cannot set up Microsoft Authenticator on a new device because their school or university account has reached the maximum limit of five authentication apps or hardware tokens.

- Product
- Microsoft Authenticator
- Device & OS
- not provided
- Scenario
- Attempting to register the Microsoft Authenticator app on a new phone after losing the previous device, but being blocked by an account limit error.
- Observed behavior
- An error message appears stating that the account has five Authenticator apps or hardware tokens, which prevents the user from adding any new authentication methods.
Before proceeding, identify the contact information for your school, university, or organization's IT helpdesk, as you will need their administrative privileges to resolve this security lockout.
Contact Your IT Administrator for an MFA Reset
Because educational and organizational accounts are managed centrally, only an administrator can clear your old devices and reset your multifactor authentication methods.
When you lose your phone, the old Authenticator app remains registered to your Microsoft 365 account. Once you hit the limit of five registered apps or hardware tokens, the system blocks new registrations for security reasons. Forum moderators and standard support cannot bypass this tenant-level restriction.
Find the contact email, support portal, or phone number for your college or university's IT helpdesk or Microsoft 365 administrator.
Contact them and clearly state that you lost your phone, have hit the five-device Authenticator limit, and need a multifactor authentication (MFA) reset.
The administrator will log into the Microsoft Entra admin center to revoke your existing sessions and remove the old authentication methods tied to your lost phone.
Once the IT admin confirms the reset, log into your Microsoft 365 account on a computer. You will be prompted to set up MFA again; follow the on-screen instructions to register the Microsoft Authenticator app on your new phone.

Stay Productive with WPS Office While Locked Out
While you are waiting for your IT department to reset your Microsoft Authenticator access, you do not have to fall behind on your assignments. You can use WPS Office as a free, offline-capable alternative to open and edit your documents without needing to bypass Microsoft's MFA lockout.
- 1. Download the software: Visit the official WPS Office website and download the free installation package for your PC or Mac.
- 2. Open your files locally: Launch WPS Office and directly open your existing .docx, .xlsx, or .pptx files from your hard drive without any cloud authentication.
- 3. Edit and save: Complete your work and save the files in standard Microsoft Office formats so they are ready to share once your account access is restored.

Frequently Asked Questions
Why does Microsoft Authenticator limit me to five apps?
Microsoft Entra restricts accounts to a maximum of five Authenticator apps or hardware tokens to prevent unauthorized device proliferation and enhance security. If you frequently change phones without removing old setups, you will eventually hit this limit.
Can I remove the old Authenticator devices myself?
If you still have access to your Microsoft account through an alternative verification method (like a backup email or phone number), you can log in, navigate to your account's Security Info page, and manually delete old devices. If you are entirely locked out, only your IT admin can do this.
Can Microsoft support forums reset my MFA limit?
No. For strict security and privacy reasons, Microsoft forum moderators and community members do not have access to organizational tenant accounts and cannot reset multifactor authentication limits for users.




