MFA & Verification Issues

How to Fix Microsoft Authenticator Setup Loop Preventing Email Sign-In

Maira Mehtab Sep 28, 2026 869 views

Question details

Users are stuck in a continuous loop where signing into Microsoft 365 requires the Microsoft Authenticator app, but the app cannot be configured without first logging into the account.

Product: Microsoft 365 / Microsoft Entra ID
Device & OS: not provided
Scenario: Attempting to sign into a Microsoft 365 email or service account on a new device or after an authentication reset.
Observed behavior: The system prompts the user to verify their identity using Microsoft Authenticator, blocking sign-in. However, the user cannot set up Authenticator because setting it up requires them to already be signed into the account.

Before you start

Ensure you have an alternative way to communicate with your organization's IT department, as bypassing an MFA lockout requires administrative privileges.

Solution 1Recommended

Request an Administrator to Reset Authentication Methods

If you are a standard user or an admin in a tenant with multiple administrators, another admin can reset your Multi-Factor Authentication (MFA) settings.

This is the most common and fastest resolution for users locked out of their Microsoft 365 accounts. A global administrator can clear your previous MFA sessions, forcing the system to prompt you for a fresh setup upon your next login.

Contact your IT administrator

Reach out to your organization's IT helpdesk or another individual with Global Administrator rights in your Microsoft 365 tenant.

Navigate to Microsoft Entra ID

The administrator must log into the Microsoft Entra admin center, go to 'Users', and then click on 'All users'.

Locate the affected account

The admin should search for and select your locked account, then select 'Authentication methods' from the left-hand menu.

Require re-registration

The admin needs to click 'Require re-register MFA' and save the changes. Once done, you can sign in again with your password and will be prompted to set up the Authenticator app from scratch.

Privacy Warning: Never post your affected account email or tenant details publicly on community forums when seeking support. Always use official support channels.

Solution 2

Contact Microsoft Support for Tenant Recovery

If you are the only administrator in your organization and are locked out, you must contact Microsoft Support directly.

Free Microsoft Office alternative

Keep Working Without Interruptions Using WPS Office

While you are waiting for your Microsoft 365 account to be recovered, you don't have to stop working. WPS Office is a free, lightweight alternative that lets you create, edit, and save documents locally without being blocked by complex online authentication loops.

1. Download the software: Visit the official WPS website and download the free WPS Office suite for your operating system.
2. Open your files directly: Launch WPS Office and open your existing Word, Excel, or PowerPoint files saved on your local drive.
3. Edit and save locally: Continue editing your documents and save them locally without needing an active Microsoft 365 login.

Fully compatible with Microsoft Office formats (.docx, .xlsx, .pptx)Work offline without requiring continuous account sign-ins or MFA appsLightweight installation ensures you can start working in minutesFamiliar user interface for seamless transition from Microsoft Office

microsoft office alternative - wps office

Frequently Asked Questions

Why does Microsoft 365 force me to use the Authenticator app?

Microsoft enables 'Security Defaults' for all new and existing tenants by default. This policy requires all users to register for Multi-Factor Authentication (MFA) using the Microsoft Authenticator app to protect against compromised credentials.

Can I bypass the Microsoft Authenticator prompt if I lose my phone?

You cannot bypass it yourself if Authenticator is your only registered MFA method. You must contact your IT administrator to reset your authentication methods, allowing you to set up a new phone or choose an alternative method like SMS verification.

How long does it take for Microsoft Data Protection to unlock an admin account?

The process can take anywhere from a few hours to several days, depending on the severity of the case and the steps required to securely verify your identity as the legitimate tenant owner.

How can I prevent an admin lockout in the future?

It is highly recommended to create a 'break-glass' or emergency access global administrator account. This account should have a highly complex password, be excluded from strict MFA security defaults, and only be used when primary admin accounts are locked out.

Login & Account Issues