Sketchy behaviour from Microsoft on MFA - what gives?
Recently, Microsoft has overwritten our Authentication Method Registration campaign settings, from 'Disabled' to 'Microsoft Managed' for dozens of tenants. Thanks guys. That's not super sketchy at all. /s This was ostensibly done for the Retiring of Voice and SMS based MFA or, as the article puts it 'To help enterprises adopt AI at scale,'.... what? Not because they're garbage MFA methods? But so Microsoft can market-capture MFA? Regardless of that bizarre statement, this article is sub par - like most Microsoft 'help' docs, it appears to have been written by someone in Marketing, with no technical experience. My chief concern is that the term 'OTP' doesn't appear ANYWHERE in here. So, for us and our customers - who block Voice/SMS already - this is alarming. Microsoft's Passkey flow is confusing af to people - and since it includes SYNCED passkeys by default, it faces the same risks as OTP. We specifically HAVEN'T rolled out passkeys because everytime we do, people get confused and frustrated - because they'll have 3-4 different things pop-up, offering to take a sync'd passkey. Really concerned with my 'do not allow microsoft to manage' setting, being explicitly set to 'Microsoft managed', and whatever decisions they're NOT publicly addressing at this point. We've spent years teaching people to use Microsoft Authenticator and password vault-based OTP. Now, Microsoft is pushing everyone to keep using those same tools, but to go through the mess that is the passkey setup interface?
Aucun accès au compte administrateur général, authentification MFA hors service
Bonjour, C'est un SOS que j'écris ici : je suis administratrice générale et la seule personne de ce compte Microsoft 365. Depuis un changement de téléphone, l'authentification MFA ne fonctionne plus : j'ai supprimé mon compte Microsoft dans l'application Authenticator sur mon ancien téléphone, puis ai téléchargé l'app sur mon nouveau. Impossible de m'enregistrer sur mon nouveau téléphone ni de retrouver l’authentification sur l'ancien : cela crée une boucle infinie de demande de code Authenticator auquel je n'ai plus accès. Aujourd'hui je n'ai plus du tout accès à mon compte : j'ai dû me connecter ici avec mon adresse personnelle pour accéder au forum. Microsoft est mon outil de travail, principalement pour l'usage de Copilot Pro, car je suis formatrice à Copilot Pro (et donc, promotrice des services Microsoft !!) J'ai tenté plusieurs fois d'appeler le service téléphonique, c'est une IA qui décroche, or son niveau de qualité de service client est déplorable, je ne m'étendrais pas ici, mais c'est une honte pour Microsoft d'un point de vue expérience utilisateur et IA... Mon ticket est existant mais je n'ai eu aucun retour, pas même le mail promis par l'IA téléphonique, qui devait sur l'adresse de secours fournie pendant le 1er échange téléphonique. En bref, je tourne en rond et n'ai aucun recours, donc je sollicite ici s'il vous plaît, s'il vous plaît, le modérateur du forum qui pourrait faire remonter mon ticket au service client ? Mon numéro de ticket : 2609 3014 2000 0444 Merci infinimentCan’t access my account, only global admin, Microsoft Authenticator issue
Hello, I had a case open a few days ago that was closed, as the issue was fixed. However a day later the same issue started happening again. I’ve got a small business and am the only global admin and cannot access any ms app through my business logins. When I go to login, it asks to setup Microsoft Authenticator (even though this has already been done), after entering the code I receive on my mobile, it says “something went wrong, please try again later”. I’ve tried calling the MS business support lines directly, however the last two days the AI just gets stuck and stops responding. This support line is terrible. is there anyway I can work around this? I can’t even access entra to turn off MFA.
Sole Global Admin locked out - lost MFA device, SSPR phone verification returns error
Hello, I am the sole Global Administrator of a Microsoft 365 Business Standard tenant and I am completely locked out of the account. What happened: - My phone with Microsoft Authenticator was physically destroyed. - I installed Authenticator on a new phone. My personal account restored from cloud backup, but the work account only appears as a "connected account" - it shows no TOTP code and receives no push notifications. Push requests still go to the old device. What I tried while my admin session was still alive: - Entra ID > per-user MFA > "Require selected users to provide contact methods again" - saved successfully. - User > Authentication methods > "Require re-register multifactor authentication" - returned "Delete operation failed. Try this command again or delete them one by one in the user authentication methods blade." - The Authentication methods list for the user was EMPTY, and default sign-in method showed "No default". "Add authentication method" button was greyed out. - "Revoke sessions" - succeeded, but this also terminated my own admin session and signed me out of Outlook and OneDrive. - aka.ms/mfasetup cannot be reached because it requires a fresh MFA challenge. Self-service password reset (passwordreset.microsoftonline.com): - First verification via alternate email succeeds every time (I have full access to that mailbox). - Second verification fails: both "Text my mobile phone" and "Call my office phone" return "Sorry, we ran into a problem contacting you." I tried +370xxxxxxx, 370xxxxxxx and 8xxxxxxxx formats - same error every time. This looks like a service-side failure, not a formatting issue. - Sign-in Helper now also reports "Account blocked due to multiple incorrect password attempts." Error codes seen: 500121 and AADSTS50133. I have tried calling Microsoft support in several countries. The automated system either asks for an internal extension number or the AI assistant disconnects the call before reaching a human. There is no second Global Admin and no recovery codes. I can provide the tenant ID, user unique identifier, subscription order number and proof of access to the billing email address privately. Requesting escalation to the Data Protection team for admin account recovery. Any guidance on how to reach a human agent would be greatly appreciated. Thank you.
Stuck in an authenticator loop
I have a 365 Business account. Haven't logged in for a while due to reasons, i was just starting up as a sole trader. Anyway decided now is the time to resurrect it and get up and running, except Authenticator doesn't work because I changed my phone, and my back up email is out of date, and no longer exists. I have tried the support web chat which wants to send a code to authenticator or my back up email. Just called the help line that referred me to the web chat which doesn't work, I couldn't get past the bot. So I am stuck. Any recovery options does not recognise my log in details, i think this is because its been a while since I logged in (I still pay but ....) but I can't resurrect it because I don't have a way of getting a code due to authenticator/back up email as cited above. I am really at a loss as to what to do. I don't want to abandon it and start again as there are documents in my one drive that I need. Can anyone help please. (I think all that needs to happen is an update to my back up email and then I can get going). I am the sole administrator on my business account.
Microsoft Teams and Authenticator lockdown
I’m having a very frustrating issue with Microsoft Teams. I am able to log in to teams using my normal personal email and account ONLY ON THE WEB BROWSER. From the web browser, I am not able to access the business channel that I am in. When attempting to log in on the downloaded mobile Teams App, I am sent directly to Microsoft Authenticator, which after waiting several hours, waiting even a full day, is still displaying a message about repeated verification attempt and to wait and try again later. I have accessed Microsoft support chat and they had no help for me. I need the authenticator lockdown to refresh and it will not.
How to target Azure VPN (Microsoft-Registered) app with Conditional Access Policies?
I have an Azure Point-to-Site VPN Gateway configured using the Microsoft-registered Azure VPN Client App ID (Audience value: c632b3df-fb67-4d84-bdcf-b95ad541b5c8). Everything is working correctly for our users. The issue I am having is that anyone with an Entra account can connect to the VPN and I want to restrict this with a blocking Conditional access policy. I do not want to create a custom app registration, because then I will have to change the 'audience' value on the app gateway and all user's will need to modify their VPN clients. The problem is I need to target the Microsoft-registered Azure VPN app in a Conditional Access policy but it does not appear in my Enterprise Applications list or in the CA app picker when searching. My questions: Why does the Microsoft-registered app not automatically create a service principal in my tenant the way other Microsoft apps do? Is there a supported way to make it appear in the CA app picker without creating a custom app registration or changing the gateway Audience value? Has anyone successfully targeted c632b3df-fb67-4d84-bdcf-b95ad541b5c8 in a CA policy while keeping it as the gateway Audience value? Thanks for the assistance here
Vaihdoit uuteen puhelimeen. Authenticator ongelma
Vaihdoit uuteen puhelimeen. Microsoft Authenticator ei ole enää saatavilla vanhalla laitteellasi. Et voi kirjautua Microsoft 365 -työtilillesi, koska MFA-vahvistus vaaditaan. Sinulla ei ole pääsyä mihinkään vaihtoehtoiseen todennusmenetelmään. Tarvitset apua suomeksi, jos mahdollista.
Unable to access Global Admin, username not recognised, need tenant recovery billing active
Unable to access Global Admin account for Microsoft 365 tenant. Username not recognised and I need tenant recovery. Billing is still active. I am the billing owner of a Microsoft 365 Business subscription for yutoriacupuncture.com.au but I have lost access to all Global Admin accounts. The original admin account email is returning “username may be incorrect”. No other admin or business emails are recognised. I have a business email associated with the admin account i can still log into. I recently briefly cancelled and reinstated my domain which may have affected tenant linkage. I also recently joined a university Microsoft 365 organisation which may be affecting sign-in routing? I have tried login.microsoftonline.com, admin.microsoft.com, password resets, and incognito browsers with no success. I have tried contacting support via phone and email but keeps cutting out, saying it can't identity me, or sends me into a loop hole with the support chat bot. I need Microsoft to escalate this to tenant recovery or Data Protection team to restore Global Admin access using billing and domain ownership verification.
mail@mydomain is causing a cert mismatch error in all browsers for Outlook.com
Hello, I have created a CNAME for our users in my domain so that they can access webmail. For example, it's called mail.mycustomdomain.com, and it is directed to Outlook.com But when I try to visit mail.mycustomdomain.com, it shows a security warning and recommends going back. I can understand because the SAN name in the certificate presented by Outlook doesn't include my CNAME. Is there anything I can do as a workaround so our users can enter the CNAME without encountering a Certificate Mismatch Error? It is causing repeated calls to the helpdesk, and we would like them to use something simple they can remember. Thanks