Reset MFA in Office 365 Safely

Ultimate Guide: How to Reset MFA in Office 365

Short answer: To reset MFA in Office 365 (now branded Microsoft 365), an administrator signs in to the Microsoft Entra admin center, opens the user's Authentication methods page, removes any stale sign-in methods, and selects Require re-register multifactor authentication. If account compromise is suspected, also select Revoke multifactor authentication sessions and reset the password. The user then re-registers Microsoft Authenticator or another approved method at their next sign-in. Always verify the requester's identity first and document the reset.

If you are searching for Office 365 reset 2FA, reset MFA for user, or Office 365 reset authenticator, treat the task as an identity-security workflow rather than a shortcut. Fraudulent MFA-reset requests aimed at help desks are a known attack technique, so verify the requester through a channel you trust before changing anything.

• Verify the request: confirm the user's identity before touching MFA methods.
• Update methods: remove lost phones, old Authenticator registrations, and unused phone numbers.
• Require re-registration: have the user set up Microsoft Authenticator or another approved method.
• Revoke sessions if needed: force existing tokens to re-authenticate when anything looks suspicious.
• Monitor sign-ins: check the Entra sign-in logs after the reset.

Two naming changes matter before you start. Microsoft renamed Office 365 to Microsoft 365, and Azure Active Directory is now Microsoft Entra ID. The admin experience lives in the Microsoft Entra admin center and the Microsoft 365 admin center — the steps below reflect both as they exist in 2026.

When managing Microsoft 365, resetting Multi-Factor Authentication (MFA) is a routine but security-sensitive task: it happens when phones are lost or replaced, when employees change numbers, and when accounts show signs of compromise.

Done correctly, an MFA reset restores access without weakening the account. Done carelessly — for example, by disabling MFA "temporarily" — it can leave the account exposed at exactly the moment it is most at risk.

This guide walks through how to reset MFA in Office 365 using the current Microsoft Entra admin center, how users re-register on Windows 11, iPhone, iPad, Android, and Mac, and how to troubleshoot the most common snags.

What Is Multi-Factor Authentication (MFA)?

Multi-Factor Authentication (MFA) requires more than one proof of identity before granting access: something you know (a password), something you have (a phone, security key, or passkey), and something you are (a fingerprint or face scan). Because a stolen password alone is not enough to sign in, MFA is designed to make account takeover substantially harder for attackers.

In Microsoft 365, the most common second factors in 2026 are the Microsoft Authenticator app (push notifications with number matching, where the user types a two-digit code shown on the sign-in screen into the app), passkeys and FIDO2 security keys, Windows Hello for Business on Windows 11 devices, and time-based verification codes. SMS and voice-call verification still exist but Microsoft classifies them as weaker methods, and many organizations restrict them by policy. Microsoft also requires MFA to sign in to its own admin portals, so there is no realistic path to simply switching it off tenant-wide.

Why You Might Need to Reset MFA for a User

Resetting MFA for a user in Microsoft 365 typically comes up in a handful of scenarios:

• Lost, stolen, or replaced phone: the old Microsoft Authenticator registration must be removed and a new one created so a missing device can no longer approve sign-ins.
• New phone number: a stale number left as a verification method can lock the user out or, worse, deliver codes to whoever now holds that number.
• Suspected compromise: if an attacker may have registered their own MFA method on the account, you need to remove every method, revoke sessions, reset the password, and re-register from scratch.
• Broken or looping prompts: corrupted registrations occasionally cause endless approval loops or "method not available" errors that only a clean re-registration fixes.
• Policy changes: moving users from SMS to Authenticator, passkeys, or Windows Hello for Business as part of a security upgrade often involves forcing re-registration.

Prerequisites: Roles and Tools You Need

First, confirm you hold the right Microsoft Entra role. Resetting MFA methods for standard users requires the Authentication Administrator role; resetting methods for admins requires Privileged Authentication Administrator. Global Administrators can also perform resets, but Microsoft's guidance is to use the least-privileged role that gets the job done rather than handing out Global Admin.

Second, know where the controls live. The primary tool is the Microsoft Entra admin center at entra.microsoft.com. The Microsoft 365 admin center offers a simpler path that links into the same controls. The old Azure AD portal experience and the standalone legacy per-user MFA portal have been folded into these admin centers.

Third, if you script resets, use Microsoft Graph PowerShell. The MSOnline and AzureAD PowerShell modules are retired and no longer function. The Microsoft.Graph module exposes cmdlets such as Get-MgUserAuthenticationMethod and Remove-MgUserAuthenticationPhoneMethod for listing and removing a user's registered methods at scale.

Finally, verify the requester before you begin. Confirm identity through a known-good channel — a video call, an in-person check, or a callback to a number already on file — not through the same email or chat thread that requested the reset. Record the verification and the reset in your ticketing system.

Step-by-Step: How to Reset MFA for a User in the Microsoft Entra Admin Center

Here is the current process to reset MFA in Office 365 / Microsoft 365:

1. Sign in to the Microsoft Entra admin center at entra.microsoft.com with an account holding the Authentication Administrator role (or higher).
2. Open the user's profile. Go to Identity > Users > All users, search for the user, and select their name.
3. Open Authentication methods. In the user's left-hand menu, select Authentication methods to see every registered method: Authenticator app registrations (with device names), phone numbers, passkeys, email, and any Temporary Access Pass.
4. Remove stale or suspicious methods. Delete the registration tied to the lost or replaced device. If compromise is suspected, remove every method you cannot positively tie to the legitimate user.
5. Select Require re-register multifactor authentication. This marks the user's MFA registration as expired, so they are walked through fresh setup at their next MFA-protected sign-in.
6. Revoke sessions if anything looks off. Select Revoke multifactor authentication sessions to invalidate remembered MFA on existing devices, and pair it with a password reset when compromise is on the table.
7. Optionally issue a Temporary Access Pass (TAP). If the user has no working method left, a TAP — a time-limited passcode issued from the same Authentication methods page (when enabled under Entra ID's authentication method policies) — lets them sign in once to register a new method without any password-only exposure.
8. Have the user re-register. Direct them to the Security info page (aka.ms/mfasetup) or simply have them sign in; they will be prompted to set up Microsoft Authenticator or another approved method.
9. Verify and document. Confirm the new sign-in works from an expected device and location, review the Entra sign-in logs for anything unusual, and note the reset in the ticket.

Alternate path via the Microsoft 365 admin center: go to Users > Active users, select the user, and choose Manage multifactor authentication. This is a convenient shortcut for the same underlying controls, though the Entra admin center gives you the fullest view of registered methods.

Helping the User Re-Register Microsoft Authenticator

After the reset, the user rebuilds their sign-in methods. The flow is the same whether they start from a Windows 11 PC, a Mac, or the phone itself:

1. Install Microsoft Authenticator on the new phone from the App Store (iPhone) or Google Play (Android).
2. Open the Security info page. In a browser, the user goes to aka.ms/mfasetup and signs in. If an admin issued a Temporary Access Pass, they enter it here; otherwise the sign-in flow itself launches registration.
3. Add the method. Choose Add sign-in method > Microsoft Authenticator, then scan the on-screen QR code with the app.
4. Approve the test prompt. Microsoft sends a push notification with number matching — the user types the displayed two-digit number into the app to complete setup.
5. Set the default and add a backup. On the same page, the user should set Authenticator (or a passkey) as the default sign-in method and register a second method so a single lost device does not lock them out again.

Two phone-specific notes: on iPhone, make sure notifications are allowed for Authenticator in Settings > Notifications; on Android, exclude the app from aggressive battery optimization if pushes arrive late. Authenticator's cloud backup can restore personal accounts to a new phone, but work or school accounts generally still require re-registration or re-approval — plan on running the QR-code flow for the Microsoft 365 account.

Troubleshooting Common Issues

• "Require re-register" is missing or greyed out: your signed-in account lacks the Authentication Administrator (or Privileged Authentication Administrator, for admin targets) role. Check your role assignments before assuming the portal is broken.
• User still gets prompts pointed at the old device: the default sign-in method may still reference a deleted registration. Have the user open the Security info page and set the new method as default.
• Sessions stay signed in after a reset: requiring re-registration does not sign anyone out. Use Revoke multifactor authentication sessions, and revoke sign-in sessions or reset the password when you need everything to re-authenticate.
• User is locked out with no working method: issue a Temporary Access Pass rather than disabling MFA. Turning MFA off, even briefly, removes the account's main safeguard at its most vulnerable moment.
• Per-user MFA vs. Conditional Access confusion: tenants running legacy per-user MFA alongside Conditional Access or security defaults can see inconsistent prompts. Microsoft's current guidance is to manage MFA through Conditional Access (Entra ID P1) or security defaults and migrate away from per-user MFA.
• App passwords failing: app passwords are a legacy mechanism for clients that predate modern authentication. Current Outlook on Windows 11, macOS, iOS, and Android supports MFA natively, so replace old profiles instead of minting new app passwords.
• Persistent setup errors: for anything beyond these, see Microsoft's official setup documentation or open a case with Microsoft support.

Security Best Practices When Resetting MFA

• Verify out-of-band, every time. Social-engineering attacks that impersonate employees to talk help desks into MFA resets are well documented. Independent identity verification is the single most important step in this whole process.
• Never "fix" a problem by disabling MFA. Use a Temporary Access Pass or an admin-guided re-registration instead.
• Treat suspected compromise as a package deal: password reset, session revocation, method removal, re-registration, and a review of Entra sign-in logs and any mailbox rules — not an MFA reset alone.
• Move toward phishing-resistant methods. A reset is a natural moment to register a passkey, FIDO2 security key, or Windows Hello for Business instead of falling back to SMS.
• Use least-privileged roles and keep records. Assign Authentication Administrator rather than Global Administrator for routine resets, and log every reset in a ticket so changes are auditable.

Frequently Asked Questions

How do I reset MFA for a user in Microsoft 365? Sign in to the Microsoft Entra admin center, go to Identity > Users > All users, select the user, open Authentication methods, remove any stale methods, and choose Require re-register multifactor authentication. The user sets up a new method at their next sign-in. The Microsoft 365 admin center's Manage multifactor authentication option under Active users reaches the same controls.

Can users reset their own MFA without an admin? Partly. If a user can still complete a sign-in with an existing method, they can add, remove, and change their own methods on the Security info page at aka.ms/mfasetup — for example, registering a new phone before wiping the old one. If they have lost access to every registered method, an administrator must reset MFA or issue a Temporary Access Pass.

How do I move Microsoft Authenticator to a new phone? Install Authenticator on the new phone, then re-add the account by signing in to aka.ms/mfasetup from any browser and choosing Add sign-in method > Microsoft Authenticator to scan the QR code. Authenticator's cloud backup can restore personal accounts, but work or school accounts usually need this re-registration step. Remove the old phone's registration once the new one works.

Conclusion: How to Reset MFA in Office 365

Knowing how to reset MFA in Office 365 the current way — through the Microsoft Entra admin center, with identity verification up front and sign-in review afterward — keeps account recovery from becoming an account takeover.

The pattern is consistent whether the trigger is a lost phone, a new number, or a security incident: verify the person, clean up the registered methods, require re-registration, revoke sessions when in doubt, and confirm the next sign-in looks normal. Pair resets with a gradual move toward passkeys and other phishing-resistant methods, and each reset leaves the account stronger than it was before.

K3 Technology is a managed IT and cybersecurity provider with offices in Denver and Dallas. If your organization wants help managing Microsoft 365 identity, MFA policy, and secure account recovery, contact K3 Technology to talk through your environment.