User stuck in a repeated Microsoft Entra MFA registration/verification loop

Symptoms

• User is repeatedly returned to the MFA registration or verification prompt and cannot complete sign-in
• The user cannot reach a working state even after attempting to register an authentication method

Environment / applicability

Microsoft Entra ID / Microsoft Authenticator

Entra ID — lifecycle: current

Diagnosis

1. Check whether an alternate authentication method already exists: As an Authentication Administrator, review the user's existing authentication methods in the Microsoft Entra admin center (Entra ID > Users > select user > Authentication methods) to see whether a usable alternate method (phone, another Authenticator registration) already exists.

   Expected: If a working alternate method exists, the user may be able to sign in with that instead of forcing a full reset.

Root cause

The official documentation does not describe a single technical root cause for a client-side MFA loop; instead it documents the supported administrative remedy: an existing or partially-configured authentication method on the account can prevent clean re-registration, and only an Authentication Administrator (or higher) can clear the user's existing methods and force a fresh registration.

Resolution

1. Require re-registration of MFA: Sign in to the Microsoft Entra admin center as at least an Authentication Administrator. Browse to Entra ID > Users, select the affected user, select Authentication methods, then select "Require re-register MFA".

   Expected: The user's hardware OATH tokens are deactivated and their phone numbers, Microsoft Authenticator app registrations, and software OATH tokens are deleted. The user is prompted to set up a new MFA authentication method the next time they sign in.

   Warning: This deletes the user's existing authentication method registrations; it cannot be selectively scoped to only the broken method.

Verification

1. Have the user sign in again and confirm they are prompted to register a new MFA method and can complete sign-in afterward.

Rollback

This action cannot be undone once applied - the deleted authentication methods must be re-registered by the user; there is no documented way to restore the exact prior method registrations.

Risk

Risk level: Medium · Requires admin: Yes

References

• Manage authentication methods for Microsoft Entra multifactor authentication — Microsoft

Record metadata

ID

fx-entra-0001

Created

2026-08-17T00:00:00Z

Updated

2026-08-17T00:00:00Z

Freshness

current