MFA & Verification Issues

How to Fix Microsoft 365 Administrator Account Locked by MFA Loop

Chanuka Geekiyanage Sep 28, 2026 869 views

Question details

The user is locked out of their Microsoft 365 administrator account because they are caught in an endless multifactor authentication (MFA) loop.

Fix Microsoft 365 Administrator Account Locked by MFA Loop

Product: Microsoft 365
Device & OS: not provided
Scenario: Attempting to log into the Microsoft 365 Admin Center or set up the Microsoft Authenticator app on a new device.
Observed behavior: The system prompts the user to approve the login using Microsoft Authenticator, but the Authenticator app itself cannot be configured because it requires authentication to proceed, effectively blocking all access.

Before you start

Ensure you have your Microsoft 365 tenant information, registered domain name, and alternative contact details ready before attempting to contact support or another administrator.

Solution 1Recommended

Ask Another Global Administrator to Reset Your MFA Settings

If your organization has more than one Global Administrator, they can easily bypass the loop by resetting the MFA requirement for your locked account.

Microsoft recommends having at least two Global Administrators for every tenant specifically to prevent complete lockouts. A secondary admin can force a re-registration of your MFA methods.

Contact a Secondary Admin

Reach out to another user in your organization who holds the Global Administrator role.

Access Active Users

Have the secondary admin log into the Microsoft 365 Admin Center, navigate to the 'Users' menu on the left pane, and select 'Active users'.

Manage Multifactor Authentication

Click on 'Multifactor authentication' in the top ribbon, find your locked account in the list, and select it.

Require Re-registration

Under the quick steps on the right side, click 'Manage user settings' and check the box for 'Require selected users to provide contact methods again', then save the changes.

Ask Another Global Administrator to Reset Your MFA Settings

Immediate Access: Once the secondary admin applies this setting, you can log in with your password and you will be prompted to set up the Microsoft Authenticator app from scratch, breaking the loop.

Solution 2

Contact Microsoft Data Protection Support

If you are the sole Global Administrator for your tenant, you must contact Microsoft Support directly to perform an account-level MFA reset.

Free Microsoft Office alternative

Experience Hassle-Free Document Editing with WPS Office

Dealing with complex Microsoft 365 administration, tenant management, and MFA lockouts can interrupt your workflow. If you want to focus on creating and editing documents without enterprise-level IT bottlenecks, try WPS Office. It provides a lightweight, fully compatible environment for your daily tasks.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx).No complex tenant administration or mandatory enterprise MFA loops required just to edit your personal or local files.Lightweight installation ensures fast launch times and smooth performance on Mac, Windows, and Linux.Includes built-in advanced PDF editing, cloud storage, and AI-powered writing assistants.

microsoft office alternative - wps office

Frequently Asked Questions

Why is Microsoft Authenticator asking for a code to set itself up?

This usually happens when an administrator enforces a Conditional Access policy or default security defaults on the account before the Authenticator app is fully configured on the user's mobile device. The login system sees MFA is required, but since the app isn't linked yet, you get caught in a paradox.

Can I bypass the Microsoft 365 MFA loop myself?

No. If you are the only global administrator and you are stuck in an MFA loop, you cannot bypass it yourself. You must contact Microsoft Data Protection Support to verify your identity and have them reset the MFA requirement from their backend.

How do I prevent admin lockouts in the future?

It is highly recommended to set up a 'break-glass' or emergency access Global Administrator account. This is a secondary admin account that uses a highly secure, complex password but is excluded from standard MFA Conditional Access policies specifically for use during emergencies.

Login & Account Issues