Locking Yourself Out with MFA

spiceuser-7mt3z · 2021-03-18T21:52:50.000Z

Hey All!

I have been struggling with an issue for some time, since I am the IT guy for my family I am generally the one who helps everyone set passwords and MFA on whatever they may need it on. Recently, I did this for my significant other on her Outlook account, but set her approval for Microsoft Authenticator up on my phone and not hers as she was about to get a new one.

Now here is the issue, I broke my cellphone (to the point of no return I should add) before we were able to backup or transfer her Authenticator to a different phone and so now we cannot authenticate any request because we would need my phone back online.

My email is set up so that we can get a code and verify her account that way, but it still wants a second verification option (password, recovery code, Authenticator) which we cannot provide.

Is there any way around this without either having to wait 30 days for Microsoft to replace the security info or have to pay to see if my cellphone can be fixed in any way? Our only other option seems to be to contact Microsoft and hope they can help in some way, so any suggestions are appreciated!

bojanzajc6669 · 2021-03-19T06:43:05.000Z

Every MFA solution must have a recovery option. Phones are broken, lost and stolen every day.

I’m not using MS MFA, but I’m pretty sure, they have some effective way to move the 2FA token to a new phone.

Kenny8416 · 2021-03-19T09:20:28.000Z

If they have your mobile number recorded they should be able to send the second verification as a SMS message (assuming you kept the same number with your new phone)

spiceuser-7mt3z · 2021-03-19T13:33:47.000Z

There is! Sadly I would have had to set up the backup from the old device’s authenticator app which is pooched. Good thought though!

spiceuser-7mt3z · 2021-03-19T13:35:35.000Z

And sorry Kenny to answer your question that is what I was referring too when I said we had my email set as a backup to receive the code, sadly we did not set up a phone number which was really dumb on my end. When we give it the code from my email it still wants that second verification that we cannot provide. Again amazing thought though, too bad I’m the dumb one and wouldn’t have this problem if I set MFA up correctly.

mattcavallin · 2021-03-19T15:16:28.000Z

Although its too late for you now, something like a Yubikey could be a good MFA backup alternative.

spiceuser-7mt3z · 2021-03-19T15:35:38.000Z

My thoughts exactly HopTroll but like you said too bad I thought of that too late. All of this was avoidable if I backed it up before hand ha-ha. Woops.

Kenny8416 · 2021-03-19T15:52:51.000Z

If you try to sign in, but select the “forgotton yoyur password” option, then from the security screen select “I don’t have an of these” it should take you to an account recovery precedure.

From memory this asked for details of recent messages etc, could be worth a shot

spiceuser-7mt3z · 2021-03-19T16:48:04.000Z

Sadly we tried this Kenny and I received an email at the verification email address saying “Since this account has MFA Security set up, these requests are automatically ignored and can’t be processed further.” We even gave them a very specific Xbox Live ID Tag from the Xbox we have her account on (which they asked for mind you) that there is no way it wouldn’t have liked the info if Microsoft simply didn’t ignore the request. They really want us to wait the 30 days to replace her info.