How to Reset an Employee Password When MFA Uses a Personal Phone
Question details
An organization needs to reset a former employee's password and retain administrative access when the account requires MFA tied to the employee's personal device.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- An employee has left the company, and their Microsoft 365 account is secured with multi-factor authentication (MFA) linked to their personal phone.
- Observed behavior
- The organization cannot log in to secure the employee's account or transfer administrative rights because the MFA prompt is sent to an inaccessible personal device.
Verify whether your organization has another active global administrator account, as account recovery processes differ significantly based on the availability of a secondary admin.
Use Another Administrator Account
If your organization has multiple administrators, a secondary admin can easily reset the password and remove the old MFA methods.
This is the fastest and most secure method. Any user with Global Administrator privileges can bypass the MFA block by resetting the user's authentication methods.
Navigate to the Microsoft 365 admin center and log in using a different global administrator account.
Go to 'Users' in the left navigation menu, then select 'Active users'. Search for and select the former employee's account.
Click on 'Reset password' at the top of the user panel and follow the prompts to generate a new temporary password.
In the user's profile, click on 'Manage multifactor authentication' or navigate to the Entra ID (formerly Azure AD) portal. Under 'Authentication methods', select 'Require re-register MFA' and delete the personal phone number.
Recover the Sole Administrator Account
If the departed employee was the only administrator, you must undergo Microsoft's official Data Protection account recovery process.
Maintain Business Productivity with WPS Office
While you resolve administrative access issues with your cloud tenant, ensure your team stays productive with WPS Office. As a powerful, lightweight alternative to Microsoft Office, it offers all the essential tools your business needs without the complex account lockouts.
Frequently Asked Questions
Can I bypass MFA if I already know the user's password?
No. If MFA is enforced on the account, having the correct password is not enough. You must either approve the prompt on the registered personal device or have another administrator clear the MFA settings.
How can I prevent a sole administrator lockout in the future?
Always ensure your Microsoft 365 tenant has at least two global administrator accounts. It is highly recommended to create a 'break-glass' admin account that does not rely on a specific individual's personal device for MFA.
Can Microsoft Support reset the password over chat?
No. For security reasons, Microsoft Support cannot reset passwords or disable MFA for administrator accounts over standard chat. The request must be escalated to the Data Protection team with formal business verification.
