Locked out of Microsoft 365 or your MFA prompt never arrives

Multi-factor authentication (MFA) is the second step after your password — usually a notification in the Microsoft Authenticator app, a six-digit code, or a text message. It is the single most effective thing protecting your email from being taken over, which is why we cannot simply switch it off when it gets in the way.

If you are stuck at that second step, work through the sections below in order. Most people are back in within five minutes.

First, work out which problem you have

Pick the line that matches what you are seeing:

• The prompt appears but I never get the notification — jump to Approval notification never arrives.
• I got a new phone and Authenticator is gone or empty — jump to You replaced your phone.
• My phone is lost, stolen, or dead — jump to No access to your phone at all.
• It says my account is locked or blocked — stop here and call us. That message usually means something else is going on, and we need to look at the account before you keep trying.

Approval notification never arrives

Nine times out of ten this is the phone, not the account.

1. Open the Microsoft Authenticator app manually. Do not wait for the pop-up. Pending approvals appear inside the app even when notifications are broken. If a request is sitting there, tap it, match the two-digit number shown on your computer screen, and approve.
2. Check the phone actually has internet. Turn Wi-Fi off for a moment and let it use mobile data, or the other way around. Authenticator needs a working connection; a phone showing full bars on a Wi-Fi network that has no internet will silently fail.
3. Use the code instead of the notification. On the sign-in screen, click I can’t use my Microsoft Authenticator app right now or Use a verification code, then open Authenticator and type the six-digit code shown next to your work account. This bypasses notifications entirely and is the fastest workaround.
4. Check the phone’s clock. Authenticator codes are generated from the current time. On iPhone go to Settings › General › Date & Time and turn on Set Automatically. On Android it is Settings › System › Date & time › Set time automatically. A clock that is even a couple of minutes out will produce codes Microsoft rejects.
5. Check notification permissions. iPhone: Settings › Notifications › Authenticator — make sure Allow Notifications is on. Android: Settings › Apps › Authenticator › Notifications. Also check the phone is not in Focus, Do Not Disturb, or a battery-saver mode that suspends background apps.

You replaced your phone

Authenticator accounts do not move automatically with a normal phone transfer unless you turned on the app’s own cloud backup before the switch.

If you still have the old phone and it powers on:

1. On the old phone, open Authenticator, tap the menu, and turn on Cloud backup (iPhone calls it iCloud backup).
2. On the new phone, install Authenticator, choose Begin recovery, and sign in with the same personal account you backed up to.
3. Recovery restores the account entry, but Microsoft still needs to verify the new device once. Follow the prompt it gives you.

If the old phone is gone or the backup was never enabled, we have to reset the method from our side. Contact us and we will clear it and send you a fresh setup link — it takes a couple of minutes, and you will be asked to re-scan a QR code.

No access to your phone at all

1. Try a backup method first. On the verification screen, click Sign in another way or I can’t use my Microsoft Authenticator app right now. If a text message or phone-call option was registered when you set the account up, use it.
2. Try a device you are already signed in to. A desktop Outlook that is still running, or a phone that already has your mail configured, will often keep working. Use it to get through the day while we sort the reset.
3. Ask us for a temporary access pass. We can issue a time-limited pass that lets you sign in once and register a new method. We will only do this after verifying who you are — expect us to call you back on a known number, or to confirm with your manager. That step is not us being difficult; it is exactly the check that stops someone impersonating you.

Before you call, have this ready

It speeds things up considerably:

• The email address you are signing in with.
• The exact wording of any error message, or a photo of the screen.
• Whether you still have the old phone.
• A phone number we can reach you on that is not the device you are locked out of.

A few things worth knowing

• Never approve a prompt you did not trigger. If your phone buzzes with an approval request out of nowhere, deny it and tell us the same day. It means someone has your password.
• Repeatedly denying prompts can lock the account for a short period. That is the system protecting you. Wait fifteen minutes rather than hammering the button.
• We will never ask you to read us a code. Anyone who calls and asks for your six-digit code is not from Iconium Networks, regardless of what their caller ID says.

---

Still locked out? Call us at 440-991-9980 or email [email protected] and we will get you back in. If you are locked out of email entirely, the phone is the faster route — we cannot reply to a mailbox you cannot open.