Quick answer
The most common cause is a phone time mismatch, wrong number or outdated Authenticator entry. First check that your phone is connected to the internet and that time is set automatically, then try another verification method. If no method works, an administrator must reset MFA or issue you new temporary access.
How to recognize the problem
- Sign-in accepts the password but stops at the verification screen
- Authenticator shows a code that Microsoft 365 rejects
- SMS or call to the verification number does not arrive
- Message that the verification method is blocked or unavailable
- Sign-in works on the phone but not on the office computer
Most common causes
Incorrect time on the phone
One-time codes in the Authenticator app depend on accurate time. If the phone is more than one minute behind or ahead, codes are rejected.
Outdated entry in Authenticator
If you changed phones or restored a backup, the old account in the app no longer matches the server state.
Wrong or inactive phone number
The SMS or call number has changed, there is no signal, or messages are blocked on the phone, so verification does not arrive.
Organization policy requires MFA
An administrator enabled conditional access that requires MFA or access only from a trusted device or trusted network, so sign-in from an unknown computer fails.
Expired or revoked access
The session expired, the password changed, or an administrator revoked sessions, so a completely new method registration is required.
Step-by-step fix
- 1
Check time and internet on the phone
Open
Settings>System>Date & time(on iPhoneSettings>General>Date & Time; names may vary slightly by manufacturer) and turn on automatic time and time zone. Check that the phone has internet, either via Wi-Fi or mobile data. Then reopen Authenticator and wait for the code to refresh. - 2
Try another verification method
On the verification screen, select
I can't use my Microsoft Authenticator app right noworSign in another way. Choose SMS, phone call or app code instead of notification. If one method fails, another often works, confirming the problem is with the method, not the account. - 3
Enter the code manually instead of approving
If the app notification does not arrive, select the option in the browser to enter a code from the app. Open Authenticator, find the work or school account and copy the six-digit code before it expires. The code is valid for about 30 seconds, so enter it immediately.
- 4
Re-register the method
Go to
https://mysignins.microsoft.com/security-infoand sign in. Before removing, check that at least one other method works; if you have no other method, do not remove the existing one, contact your administrator instead. Remove the outdated Authenticator entry, then selectAdd sign-in methodand scan the QR code again. If identity verification is requested, use a method that still works. - 5
Clear browser cache and try a private window
In Chrome or Edge, open a new private window and try signing in. If it works there, clear cookies for Microsoft sites in the browser privacy settings (in Chrome
Settings>Privacy and security>Cookies and other site data). Avoid multiple parallel sign-in attempts in different windows. - 6
Check if you are on a trusted network
Some organizations require MFA only outside the office network or from unknown devices. If sign-in fails from a home computer but works in the office, contact your administrator to check the conditional access policy. Do not disable VPN randomly if you use it according to company instructions.
- 7
Request MFA reset from administrator
If no method works, an administrator in the Microsoft Entra admin center (or Microsoft 365 admin center, depending on organization settings) can reset MFA for your account. After the reset, sign-in will require new method registration. Also request a temporary password if you are locked out of the account.
If nothing helps
When all methods are exhausted, an administrator should check sign-in logs in the Microsoft Entra admin center, in the monitoring and sign-in logs section. There you can see the exact reason for rejection, such as failed MFA, blocked conditional access or wrong password. If the account is locked due to too many attempts, wait a few minutes before trying again. In companies with multiple employees, it is good to have at least two registered methods in advance, such as Authenticator and a backup phone number, so one lost phone does not block work. For accounts with sensitive data, consider security keys as a backup method.
How to prevent it
- Keep automatic time and time zone enabled on the phone
- Register two verification methods, the app and a backup number
- Update the phone number in security info as soon as it changes
- Do not share verification codes and do not approve sign-ins you did not initiate
When to call a professional
Contact IT support if you have no working verification method, if the account is locked, or if you suspect someone else tried to sign in. Only an administrator can reset MFA and check sign-in logs.
IT infrastructure maintenance · Servers, networks, backup, security and helpdeskFAQ
Why is my Authenticator code constantly rejected?
Most often due to incorrect time on the phone or an outdated entry in the app. Turn on automatic time, then remove and re-add the account in Authenticator via the security info page.
Can I sign in without MFA?
Not if your organization requires MFA. An administrator can temporarily issue another method or reset MFA, but completely disabling MFA reduces account security and is not recommended.
What should I do if I lost the phone with Authenticator?
Sign in with another method if registered, such as SMS or call. If you have no other method, contact your administrator to reset MFA and issue new access.