MFA & Verification Issues

How to Find a User Linked to a Conflicting Phone Number with PowerShell

Maira Mehtab Sep 22, 2026 869 views

Question details

An administrator needs to identify which account in the Microsoft Entra tenant is already associated with a specific phone number, as the conflict prevents another user from enabling SMS sign-in.

Product: Microsoft Entra ID / PowerShell
Device & OS: not provided
Scenario: Attempting to enable SMS sign-in or configure MFA authentication methods for a user.
Observed behavior: The system prevents enabling SMS sign-in, returning an error that the phone number is already associated with another user in the tenant.

Before you start

Ensure you have the Microsoft.Graph.Identity.SignIns module installed in PowerShell and that your administrative account possesses Global Reader, Privileged Authentication Administrator, or Global Administrator rights.

Solution 1Recommended

Use Microsoft Graph PowerShell to Locate the Conflicting Number

Querying user authentication methods via the Microsoft Graph PowerShell SDK is the most reliable way to find which account holds the duplicate phone number.

Because the Microsoft Entra admin center GUI has limited capabilities for searching users backward by their registered MFA phone numbers, running a script through the Graph SDK allows you to iterate through all accounts and pinpoint the conflict.

Install the Microsoft Graph SDK

Open PowerShell as an Administrator and execute 'Install-Module Microsoft.Graph.Identity.SignIns' to ensure you have the necessary commands available.

Connect and Authenticate

Run 'Connect-MgGraph -Scopes "UserAuthenticationMethod.Read.All"' and sign in using your administrator credentials.

Run the query script

Execute a loop to check phone methods. For example: '$users = Get-MgUser -All; foreach ($user in $users) { $phones = Get-MgUserAuthenticationPhoneMethod -UserId $user.Id; if ($phones.PhoneNumber -eq "+1 5551234567") { Write-Host "Conflicting User:" $user.UserPrincipalName } }', replacing the placeholder number with the conflicting one.

Resolve the conflict

Once the conflicting UserPrincipalName is identified, navigate to their profile in the Entra admin center under Authentication methods, and remove or update the phone number to free it up for the correct user.

Phone Number Formatting: Ensure the phone number queried in your PowerShell script strictly matches the E.164 format (e.g., +1 5551234567) exactly as it is stored in the Microsoft Entra ID database.

Free Microsoft Office alternative

Document Your PowerShell Scripts and IT Configurations with WPS Office

While resolving Microsoft Entra ID authentication conflicts requires PowerShell, WPS Office provides IT administrators with a free, lightweight suite to document scripts, manage tenant data in spreadsheets, and create configuration manuals.

Seamlessly compatible with Microsoft Word, Excel, and PowerPoint formatsFree and lightweight alternative to expensive enterprise Office subscriptionsFamiliar user interface makes migrating your IT documentation fast and easyPerfect for maintaining organized PowerShell script repositories and audit logs

microsoft office alternative - wps office

Frequently Asked Questions

Why does Microsoft Entra ID prevent duplicate phone numbers for SMS sign-in?

Entra ID requires unique phone numbers for SMS sign-in to ensure secure, unambiguous user identification during the authentication process. Allowing duplicates could lead to compromised security and routing errors.

Can I find the conflicting user from the Microsoft Entra admin center GUI instead of PowerShell?

Currently, searching by an authentication phone number directly in the Entra ID portal is restricted. PowerShell remains the recommended and most efficient method to query authentication methods across all users in a tenant.

What if the PowerShell script returns no users but the conflict still persists?

The phone number might be tied to a recently deleted user still residing in the recycle bin, or it might be registered as an alternate mobile number rather than a primary authentication method. Check the standard 'MobilePhone' property on user profiles as well.

Login & Account Issues