For Microsoft 365, reset 2FA by role: if the user still has another sign-in method, have them use Security info; if they’re locked out, a Global Admin or Authentication Administrator must reset MFA in Microsoft Entra admin center. Using the wrong path can leave the account blocked, trigger help desk loops, or weaken tenant access controls. This guide shows which MFA reset path fits your tenant model, user access state, and admin role.
Choosing between self-service and admin reset
This topic is about Microsoft 365 work or school accounts, not personal Microsoft accounts. If the user can still sign in somewhere, send them to mysignins.microsoft.com/security-info to manage sign-in methods. If they cannot sign in anywhere, use the admin path in Microsoft Entra admin center. The goal is usually to require re-registration, not to turn protection off permanently.
What changes after a reset
When you use Require re-register multifactor authentication, the user is forced to set up MFA again at next sign-in. Microsoft guidance also ties this flow to Revoke multifactor authentication session so the old session stops being useful. Re-registration generally removes registered methods and may deactivate hardware OATH tokens, so confirm a replacement method is ready first. (Microsoft Learn)
When the user should use self-service security info
If the user still has one working sign-in method, self-service is the least disruptive path. Have them update methods in Security info before you touch the admin reset. A common first-timer mistake is removing the broken method before a new one is verified; that can lock the user out of the account completely.
📊 The Microsoft Support page covers sign-in help for Microsoft 365 and Office apps. Source: Sign in to Microsoft 365.
Likely causes
Most MFA reset requests start with a lost phone, a broken Microsoft Authenticator setup, or a user who is locked out everywhere. Less commonly, the problem is that the tenant uses a different security model than the admin expected, so the expected reset button is missing or disabled.
Lost phone or replaced device
Suppose the user gets a new phone and the old authenticator app is gone. The account may still be valid, but the second factor is not. Use the admin reset path if the user cannot sign in, or use Security info if the user still has a remaining method available. Temporary Access Pass is a fit only when the tenant uses Microsoft Entra ID and TAP is enabled by policy.
Microsoft Authenticator is installed but no code appears
If the Microsoft Authenticator app is present but not generating a code, the method is present but unusable. This is one of the common reasons a user needs a reset. First check whether the user can still sign in with another method. If not, move to the admin reset and require re-registration.
User is locked out everywhere
When the user cannot sign in on any device, the admin needs to act in Microsoft Entra admin center. Use the user record, then choose the reset and sign-in invalidation steps. The result should be a fresh MFA setup prompt at the next sign-in. A locked-out user does not need a generic password reset unless the password itself is also unknown.
Tenant settings hide the expected reset path
If the portal does not show the action you expected, the tenant model is probably the reason. Per-user MFA, Conditional Access, and Security defaults do not behave the same way. Security defaults is tenant-wide and does not support a per-user bypass. Conditional Access can exclude a user from a policy, but that is not the same as per-user MFA.
MFA reset decision table
| Recovery scenario | Correct reset path | Required admin role | Expected outcome |
|---|---|---|---|
| Locked out everywhere | Microsoft Entra admin center → user → Require re-register multifactor authentication, then Revoke multifactor authentication session | Global Admin | User must set up MFA again at next sign-in |
| Lost phone | Use Security info if any method still works; otherwise Entra re-registration | Authentication Administrator or Global Admin | Old device method stops being the blocker |
| Authenticator app present but no code | Entra re-registration, then require a new method | Global Admin | Authenticator can be set up again on next sign-in |
| Per-user MFA tenant | Microsoft 365 admin center legacy MFA controls, if exposed in that tenant | Global Admin or authentication-capable admin | Per-user MFA can be changed for the account |
| Conditional Access tenant | Entra admin center; adjust user auth methods or policy exclusions as needed | Global Admin or Conditional Access admin | Policy path changes, not per-user MFA controls |
| Security defaults tenant | Tenant-wide security defaults change, not a per-user exception | Global Admin | Security defaults must be changed at tenant level |
How do you reset MFA in Microsoft Entra admin center?
Use Microsoft Entra admin center when you need the standard admin reset for a Microsoft 365 work or school account. Microsoft guidance points Global Admins to Entra for this task, and the reset flow includes requiring the user to re-register MFA. This is the main path when the user is locked out or the app is not working.
Find the user in the admin portal
- Sign in to Microsoft Entra admin center with a Global Admin account.
- Go to Users and open the affected user.
- Confirm the identity before changing any authentication method.
Use require re-register multifactor authentication
- Open the user’s authentication methods or MFA controls.
- Select Require re-register multifactor authentication.
- Save the change, then sign the user out if the portal offers that step.
This action forces setup again on next sign-in and removes registered methods from the account. It also deactivates hardware OATH tokens, so do not use it unless the user can set up a new method right away.
Use revoke multifactor authentication session
- In the same user record, choose Revoke multifactor authentication session.
- Apply it before or alongside re-registration when you need a fresh sign-in.
- Tell the user to sign in again and follow the MFA prompts.
This step helps cut off the old session so the account has to authenticate again. It is useful when the user is still signed in on a device but the existing second factor no longer works.
How do you reset MFA in Microsoft 365 admin center?
Some tenants still expose older MFA controls in Microsoft 365 admin center, especially where per-user MFA is in use. Use that portal only when the tenant still offers the legacy controls. In many environments, the identity area routes you back into Microsoft Entra admin center, which is now the primary place to manage user authentication methods.
Use the identity or users area
- Open Microsoft 365 admin center.
- Go to the Users or Identity area.
- Open the user and look for authentication or sign-in settings.
When the legacy path appears
- If per-user MFA controls appear, use the tenant’s built-in MFA management screen.
- Change the user’s MFA state only after you confirm the tenant is using per-user MFA.
- If you also need a method reset, continue in Entra admin center.
When the portal redirects to Entra admin center
- Follow the redirect to Microsoft Entra admin center.
- Use the Entra user record for the reset action.
- Finish with re-registration, then verify the next sign-in prompt.
What if the user still has a signed-in device?
If the user is signed in on one device, keep at least one working method until a new one is verified. That lowers the risk of a full lockout. If the user can still sign in, the safest path is to open Security info, add the new method first, confirm it works, and only then remove the broken one.
Use Security info when the user can still sign
- Go to mysignins.microsoft.com/security-info.
- Add a new phone, app, or other supported sign-in method.
- Confirm the new method works before removing the old one.
Use Temporary Access Pass when the tenant supports it
Temporary Access Pass is a recovery option for a lost phone or broken authenticator when the tenant has Microsoft Entra ID and TAP is enabled by policy. It gives the user a temporary way to sign in and then register a new method. If TAP is not enabled, use the standard Entra reset flow instead.
Picture a user with a signed-in laptop and a dead phone. The account still works on the laptop, so the admin should add a replacement method in Security info first. That avoids the mistake of deleting the old method before the new one is live.
What if the reset path is missing?
If the GUI option is missing, start by checking the admin role and the tenant model. The most common cause is a role gap or a tenant that uses Conditional Access or Security defaults instead of per-user MFA. If the admin cannot change authentication methods in the portal, use the supported tenant path rather than forcing the wrong screen.
Check the admin role first
- Confirm whether the signed-in admin is a Global Admin or has the needed authentication permissions.
- If the role is too limited, grant the right access or hand the task to a Global Admin.
- Retry the reset in Microsoft Entra admin center.
Check whether the tenant uses per-user MFA, Conditional Access, or Security defaults
- Review the tenant’s MFA model in the admin center.
- If it is per-user MFA, use the legacy Microsoft 365 admin center controls where available.
- If it is Conditional Access, work through the policy and user authentication method settings in Entra.
- If it is Security defaults, there is generally no normal per-user exception path.
Escalate when the portal will not change the method
- Verify the user’s identity again before any change.
- Use the supported portal for that tenant model.
- If the portal still blocks the change, escalate to a Global Admin who can manage tenant authentication settings.
Frequently asked questions
How do I reset 2fa for a Microsoft 365 account?
Open Microsoft Entra admin center, find the user, and choose Require re-register multifactor authentication. If the user still has access to another method, send them to mysignins.microsoft.com/security-info first. That keeps recovery inside the correct work or school account path.
How can an admin reset 2fa for a user in Microsoft 365?
A Global Admin should use the user record in Microsoft Entra admin center, then apply Require re-register multifactor authentication and, if needed, Revoke multifactor authentication session. That combination clears the old sign-in path and sends the user back through MFA setup at the next sign-in.
How do I require re-register multifactor authentication?
Go to Microsoft Entra admin center, open Users, select the account, and choose the option to require re-registration. Microsoft guidance says this is the reset action that forces setup again on next sign-in. It also removes registered methods and deactivates hardware OATH tokens.
What if Microsoft Authenticator is not generating a code?
If the app is installed but not producing a code, the second factor is not usable. Check whether the user has another method or a signed-in device, then either update Security info or use the Entra reset flow. If the tenant supports it, Temporary Access Pass can bridge the recovery.
Can I disable MFA for one user in Microsoft 365?
Only sometimes. In a per-user MFA tenant, legacy controls in Microsoft 365 admin center may allow a per-account change. In a Conditional Access tenant, you usually adjust policy or user exclusions instead. In a Security defaults tenant, there is no normal per-user exception; changes are tenant-wide.
How do I reset MFA if the user lost their phone?
If the user can still sign in another way, go to mysignins.microsoft.com/security-info and add a new method first. If they cannot sign in anywhere, use Microsoft Entra admin center to require re-registration. Temporary Access Pass is an option only when the tenant has Microsoft Entra ID and TAP is enabled by policy.