MFA Issues and Account Lockouts (Microsoft 365)

Problem

A user cannot complete multi-factor authentication, or their Microsoft 365 account is locked.

Symptoms

• MFA prompt never arrives, or is rejected
• Lost or replaced MFA device
• Account shows "locked" or "blocked for sign-in" in the admin center

Possible Causes

• MFA device lost, replaced, or out of sync (time drift on authenticator app)
• Too many failed sign-in attempts triggering a smart lockout
• Account explicitly disabled by policy or by an admin
• A genuine unauthorized access attempt

Diagnostic Steps

1. Check the sign-in logs in the Microsoft 365 admin center for the specific failure reason
2. Confirm whether this is a lockout, an MFA delivery problem, or a disabled account — they need different fixes
3. Check for unfamiliar sign-in locations in the logs before assuming it's routine

Commands & Tools

Step-by-Step Solution

1. For a lost MFA device, an admin resets MFA registration so the user can re-enroll
2. For smart lockout, wait out the lockout window or have an admin manually unlock the account
3. For time-drift issues with an authenticator app, resync device time
4. If sign-in logs show clearly unfamiliar locations, treat as a potential compromise, not routine support — rotate the password immediately

Verification

User successfully completes sign-in with MFA and the account no longer shows as locked in the admin center.

Common Mistakes

• Resetting MFA without checking sign-in logs first, potentially missing a real compromise
• Assuming every lockout is routine user error
• Not checking for time-sync issues on authenticator apps

Escalation Criteria

Prevention

Enable passwordless or FIDO2 options where possible, set sensible smart lockout thresholds, and review sign-in logs periodically for patterns.

Related Articles