Identity & Authentication topics

Not able to do an account recovory when 2FA is enabled and Passkeey is half set up

Jonathan-Franklin — Thu, 30 Jul 2026 14:14:33 GMT

I am not able to log into my personal account.

I have tried account recovery, but I have 2FA set up so I go a message saying this is ignored.

I have rest the password using 2FA but when I try to login the message is that I can not use password to login.

I beleive my partern loged me out of the account and tried to log in to her account but instead started Passkey set up.

I have needed to login with my company account even to raise this post.

Any help would be great.

Authenticator não funciona

FJunior2026 — Thu, 30 Jul 2026 14:00:27 GMT

Tenho um e-mail corporativo (sou o adm único, nao tem ti) que faço login na conta do powerbi, contudo, meu celular com o authenticator foi perdido e já nao tenho mais acesso, por este motivo, nao consigo mais logar na conta pq ele sempre direciona para o authenticador que nao tenho mais acesso e não abre a possibilidade de receber o codigo por outro meio, (sms ou email). ja tentei vários recursos (chat, telefone do suporte) para recuperar a conta e nao consigo. Todas as opções direcionam para o autenticador. solicito a microsoft que dê uma solução, resetando o autenticador anterior para que eu possa acessar a conta e incluir métodos alternativos de desbloqueio, ou sugira outra solução.

M365, Entra ID, Google Password Manager Passkeys

EMR88 — Sun, 26 Jul 2026 21:23:38 GMT

I went into my tenant, opened the Entra ID Admin, and enabled passkeys (fido2) authentication. I want to use Google Password manager since it will work across al my devices/platforms (Windows, Mac, Android, iOS).

I went into the security settings for Microsoft 365 account to add an authentication method. I am happy to say that "passkey" is listed as an option, so I created a new passkey in Google Chrome/Password Manager and named it after my userid in the tenant. To test it, I logged out and attempted to log in using the passkey. The option came up, but Microsoft complained it was not a valid key. I tried again stating that I would my phone for the key and scanned the QR code but my phone said there is no passkey I would need to create one. How do I solve this?

BTW: I did add Google's AAGUID in the Entra admin and allowed it but that did not solve the issue.

Strange redirect when signing in - phishing?

workless — Sun, 26 Jul 2026 02:23:17 GMT

I just restarted my Business Standard 365 license today and this afternoon got an email from

email address removed for privacy reasons

with the following content:

But when I clicked on the 'Verify payment information' button I am redirected to a page with the following URL:

https://admin.cloud.microsoft/Error/UnAuth?errorCode=100014

looking like this:

This looks highly suspicious (Times New Roman font, URL with no top-level extension such as .com, unusual graphics).

Is this legitimate or a phishing attempt?

Now, when I try to login to admin.microsoft.com to check my account the same suspicious "Sign out and login with a different account" page pops up repeatedly.

Trapped in an Authenticator Loop

LukasMaerz — Tue, 21 Jul 2026 07:49:27 GMT

Dear Community, please help!

I am trapped in an Authenticator Loop. I've got a microsoft workplace account, but if I want to log in, I have to type in a code from the microsoft authenticator app. I downloaded the app, but in order to use it, I have to log into my account and in order to do so, I also have to type in a code from the authenticator app, which I don't get, because to get the code I would have to log into the authenticator app, what I would need a code for... No matter which link I click, I can't open anything before I enter the code, which I can't get.

I am using teams on mac, either on a firefox browser or on the desktop app and the authenticator on an Iphone. Please don't just tell me "don't use teams on a mac", this wasn't my choice. Unfortunately, my emplyer's IT support also is chronically unavailable. So is here anyone who could help me? I've already gone through the usual deleting the app, using another browser etc. options.

Best

Lukas

Vaihdoit uuteen puhelimeen. Authenticator ongelma

Päivi — Tue, 14 Jul 2026 08:50:57 GMT

Vaihdoit uuteen puhelimeen.
Microsoft Authenticator ei ole enää saatavilla vanhalla laitteellasi.
Et voi kirjautua Microsoft 365 -työtilillesi, koska MFA-vahvistus vaaditaan.
Sinulla ei ole pääsyä mihinkään vaihtoehtoiseen todennusmenetelmään.
Tarvitset apua suomeksi, jos mahdollista.

Microsoft Authenticator receives repeated unexpected sign-in requests from different countries.

Just-Alex22 — Sat, 11 Jul 2026 05:04:56 GMT

I have received multiple unexpected Microsoft Authenticator number-matching requests over the last few weeks. The requests came from different countries (Mexico, France, and Spain), and I denied all of them. I changed my password after the first incident. My password is unique and stored in Bitwarden. I have Microsoft Authenticator enabled, and I do not use passwordless sign-in. The strange part is that these authentication requests do not appear in my Recent Activity page. Is there anything I can do to stop these requests? I came here because a support representative told me to. I appreciate all your help beforehand.

Device Bound Session Credentials Edge

markjanbakker — Wed, 01 Jul 2026 09:57:12 GMT

Hi everyone,

For a customer i did some research about token protection within M365. I did find a lot information what to configure within M365 to get a multi layer protection (CA, Identity Protection, device compliance, etc).

What i didn't found was a solution for token/cookie protection from the browser, until i found this article:

https://en.ittrip.xyz/windows/edge/edge-147-device-bound#index_id0

This article states that edge 147 supports Device Bound Session Credentials which makes it much harder to do a off-device replay of a cookie.

It also is saying:

If you buy rather than build, ask your identity provider or SaaS vendor a direct question: do you have a roadmap for Device Bound Session Credentials or an equivalent browser-session binding model?

So my question is: Does M365 (via the browser) supports Device Bound Session Credentials or will it be supported any time soon?

Hope you have a nice day!

Regards,

I received 2FA request but I can't identify the source

SteveRodrigue — Fri, 26 Jun 2026 11:48:04 GMT

Since a couple of weeks, I've started received unwanted prompt on my phone to "confirm my identity": asking me to approve (second factor).

Obviously, this isn't me and I reject those. At first, I was thinking it was just some phishing/stuffing attack, but I tried to find out how I could see those attempts and it is impossible to see "failed attempt" on the Windows Account web page or on the 2FA application.

I have no clue how to investigate this, I would like to confirm what is the "source" of these attempts. Is there any way to have more extensive logs?

Lost Backup with Microsoft Authenticator

PASCO — Tue, 23 Jun 2026 13:03:03 GMT

Hello,

I lost the phone where I had set up 2FA using Microsoft Authenticator for this email address.

I had previously enabled cloud backup and have now tried to restore it to a new phone by carefully following the correct backup and recovery process.

However, some very valuable and critical 2FA accounts are still missing and were not restored.

Unable to access Global Admin, username not recognised, need tenant recovery billing active

Deleted — Tue, 23 Jun 2026 02:25:48 GMT

Unable to access Global Admin account for Microsoft 365 tenant. Username not recognised and I need tenant recovery. Billing is still active.

I am the billing owner of a Microsoft 365 Business subscription for yutoriacupuncture.com.au but I have lost access to all Global Admin accounts.

The original admin account email is returning “username may be incorrect”.

No other admin or business emails are recognised. I have a business email associated with the admin account i can still log into.

I recently briefly cancelled and reinstated my domain which may have affected tenant linkage. I also recently joined a university Microsoft 365 organisation which may be affecting sign-in routing?

I have tried login.microsoftonline.com, admin.microsoft.com, password resets, and incognito browsers with no success. I have tried contacting support via phone and email but keeps cutting out, saying it can't identity me, or sends me into a loop hole with the support chat bot.

I need Microsoft to escalate this to tenant recovery or Data Protection team to restore Global Admin access using billing and domain ownership verification.

AAD multiple accounts from same realm is not supported by clients.

rootsmusic — Sun, 21 Jun 2026 23:03:50 GMT

I've signed out of Excel for iPadOS 2.101.25100311. I've closed (not forced shutdown) and reopened the app. I'm trying to sign in with a different Microsoft account. However, it shows the error: "Another account from your organization is already signed in on this device". How can I completely sign out of that other account? The troubleshooting details are below.

Correlation Id: 5520852a-4877-ec4c-97be-f3de2c079058
Timestamp: 2026-06-21T22:49:29.000Z
DPTI: FAF41146-8AF4-425C-95EE-1654DD13C47C
Message: AAD multiple accounts from same realm is not supported by clients.
Tag: 5pzx9

Lost Backup with Authenticator App

ROD91 — Sat, 20 Jun 2026 22:52:52 GMT

I recently changed phones and followed Microsoft’s documented process for transferring my Authenticator accounts.

Before changing devices, I enabled cloud backup and confirmed that authenticator showed a successful backup dated 21 June. I then installed the app on the new phone, selected the recovery option, and signed in using the same Microsoft account. Both phones used the same operating system, and all required cloud settings were enabled.

Despite this, only two of my seven accounts were restored on the new phone.

The app on my old phone then stopped working. I disabled VPNs, cleared the cache, confirmed a stable internet connection, checked notification permissions, and ensured battery optimisation was not interfering. When none of this worked, I updated the app. After the update, the remaining account data had disappeared, leaving only the same two accounts restored on the new phone.

I followed the correct backup and recovery process. The app confirmed that the backup had completed successfully, yet five of seven accounts were not restored.

Is there any way to recover an earlier backup or should I assume that the data I need is lost because of this useless app?

mail@mydomain is causing a cert mismatch error in all browsers for Outlook.com

midiman — Tue, 16 Jun 2026 16:12:03 GMT

Hello,

I have created a CNAME for our users in my domain so that they can access webmail.

For example, it's called mail.mycustomdomain.com, and it is directed to Outlook.com

But when I try to visit mail.mycustomdomain.com, it shows a security warning and recommends going back.

I can understand because the SAN name in the certificate presented by Outlook doesn't include my CNAME.

Is there anything I can do as a workaround so our users can enter the CNAME without encountering a Certificate Mismatch Error?

It is causing repeated calls to the helpdesk, and we would like them to use something simple they can remember.

Thanks

How should home and small org users address Kali365 Hijacking Microsoft 365 Access Tokens?

Mark843 — Mon, 15 Jun 2026 13:49:52 GMT

How should home and small organization small business users address the recent Federal Bureau of Investigation Public Service Announcement “to warn the public about an emerging Phishing-as-a-Service platform called Kali365, first seen in April 2026”

See Alert Number I-052126-PSA 21 May 2026

How do I get support so I don't loose my account?

workless — Fri, 29 May 2026 12:37:31 GMT

I have a business 365 account but changed address and so my credit card payments stopped. However, I can't log in to my account because I also have an authentication problem (my authentication app on iPhone is still working but the entry for this account has gone and there is a new one called "Microsoft Entra ID" but when I go to get the authentication code this "Entra ID" authenticator does not produce it).

To get help from Microsoft it always asks for authentication. I would like to keep this account and start paying again but I can't find a way to get help to fix the authentication problem because raising a ticket or talking to an agent requires authentication.

I got my final warning email today saying

Warning—your online services will be deprovisioned and your data deleted in seven days

There must be some way to get a call from Microsoft so I don't loose my account and all my data?

Microsoft Authenticator führt Wiederherstellung nicht aus

Marko13059 — Wed, 27 May 2026 13:13:06 GMT

Ich möchte die App auf meinem neuen Handy weiter nutzen und habe dafür auf dem alten Gerät eine Sicherung erstellt.

Wenn ich nun die App auf dem neuen Handy einrichten möchte, bekomme ich eine Fehlermeldung, daß es angeblich keine Sicherung gibt.

Ich benötige die App dringend für die MFA.

Kann jemand helfen?

How do I find the account linked to an Office Home & Student 2013 key?

Kévin — Mon, 25 May 2026 15:35:35 GMT

Hello everyone,

Microsoft's after-sales service redirected me here because they no longer provide updates for this type of product, nor even security support.

I have two Microsoft accounts. However, when I try to reconnect my key to one of them, it tells me the key is already linked to another Microsoft account. But which one?! How can I find that account or regain ownership of my Office key ?

Thanks for your help.

Web-signin 3rd party IDP not working

GeorgJ — Mon, 11 May 2026 11:55:40 GMT

We have a working Entra ID SAML federation to a third-party IdP that uses FIDO2/WebAuthn (IdP as Relying Party) for browser sign-in, and we are trying to use the same federation through Windows Web sign-in on an Entra-joined Windows 11 device — but the IdP page loads blank in the WebView and Microsoft-Windows-WebAuthN/Operational records zero events, while the same security key works fine for FIDO2 sign-in with login.microsoft.com as RP on the same device.

Questions:

- Is WebAuthn brokering to third-party Relying Parties inside the Web sign-in WebView supported?

- If not, is it on the roadmap?

- What is the supported architectural path for delivering passwordless Windows sign-in using a federated IdP's own FIDO2/WebAuthn credentials, given Graph API passkey provisioning is Beta-only?

How to target Azure VPN (Microsoft-Registered) app with Conditional Access Policies?

mmarchand — Sun, 03 May 2026 19:48:53 GMT

I have an Azure Point-to-Site VPN Gateway configured using the Microsoft-registered Azure VPN Client App ID (Audience value: c632b3df-fb67-4d84-bdcf-b95ad541b5c8). Everything is working correctly for our users. The issue I am having is that anyone with an Entra account can connect to the VPN and I want to restrict this with a blocking Conditional access policy. I do not want to create a custom app registration, because then I will have to change the 'audience' value on the app gateway and all user's will need to modify their VPN clients.

The problem is I need to target the Microsoft-registered Azure VPN app in a Conditional Access policy but it does not appear in my Enterprise Applications list or in the CA app picker when searching.

My questions:

Why does the Microsoft-registered app not automatically create a service principal in my tenant the way other Microsoft apps do?
Is there a supported way to make it appear in the CA app picker without creating a custom app registration or changing the gateway Audience value?
Has anyone successfully targeted c632b3df-fb67-4d84-bdcf-b95ad541b5c8 in a CA policy while keeping it as the gateway Audience value?

Thanks for the assistance here