Reset a user's MFA registration

Requiring re-registration clears a user's registered authentication methods so they

enrol again at their next sign-in. It is the correct fix when the registered method

no longer exists or is no longer trusted.

When this is the right action

• The device holding the authenticator was lost, replaced, wiped, or traded in.
• The user has left a phone number or authenticator behind at a previous employer.
• An attacker may have registered a method (see Responding to a compromised account).
• The registration is stale and the user cannot satisfy any challenge.

When it is not

• Sign-in failures at stage 1 (invalid credentials, expired password, lockout).

Re-registration does nothing for those and can strand the user further.

• Conditional Access blocks (device compliance, location, app protection). MFA is

already being satisfied in those cases — clearing it turns a partial block into a

complete lockout.

• As a first move on any ticket where you have not read the sign-in logs.

Verify the caller first — every time

An MFA reset request is the standard opening move in an account-takeover attempt.

The attacker has the password and needs the second factor removed. They will be

plausible, polite, and in a hurry.

Do not clear MFA on the strength of a phone call alone. Verify through a channel

that is independent of the request — a callback to the number in the directory,

confirmation from the line manager, an in-person check, or a verified helpdesk

identity workflow. Record how you verified in the ticket.

Pressure to skip verification is itself a signal. A genuine user with a client call

in twenty minutes will accept a two-minute callback; someone who refuses one is

telling you something.

Procedure

1. Read the sign-in logs and confirm the failure is at strong authentication

(50074, 500121, or similar). Confirm primary authentication is succeeding.

1. Read the registered authentication methods. Note what is registered, to which

device, and when it last responded.

1. Verify the caller's identity and record how.
2. Require re-registration for the user.
3. If the user cannot sign in far enough to reach security-info registration, issue

a Temporary Access Pass — time-limited, single or multi-use, and it satisfies

the MFA requirement long enough to enrol.

1. Stay on the call while they enrol. Confirm they can open a service that requires

MFA before you close.

Afterwards

• Encourage a second method (an authenticator plus a phone, or a security key).

A single registered method is exactly how this ticket happens.

• If the reset followed a suspected compromise, revoke sessions and reset the

password as well — clearing MFA alone does not evict an attacker holding a valid

refresh token.

Related

• Reading sign-in failure codes (AADSTS)
• Verifying a caller's identity
• Responding to a compromised account