The user has a new phone and the old one is in a drawer, or a river. Or they have a phone, but the Authenticator app is gone, or the push never arrives. Either way they cannot sign in, and they are calling you.
This is a higher-risk ticket than a password reset, because the second factor is what stands between a stolen password and the mailbox. Here is the process for Microsoft Entra ID: verify hard, reset the methods, get the user working with a Temporary Access Pass, and make sure the next lost phone is a non-event.
Verify identity harder than for a password reset
An attacker who has a user's password only needs one thing from you: a way past MFA. "I lost my phone, can you reset my MFA" is the exact script they use. Do not act on an email or a chat message. Call the user back on the number in the HR record, or require a video call with a manager present, or have them come to the desk with ID. Write down in the ticket how you verified.
Be extra careful with anyone in a privileged role, finance, or the executive team. Those are the accounts attackers target, and a strict process is easier to justify before an incident than after one.
Reset the user's methods in Entra ID
In the Entra admin center open Users, pick the user, and go to Authentication methods. You will see every registered method: Authenticator app with the device name, phone numbers, email, FIDO2 keys, Windows Hello. Delete the method tied to the lost phone. Do not delete a method the user still has, such as a desk phone number or a hardware key, because that is their fastest way back in.
If you are not sure what is still valid, use Require re-register multifactor authentication from the same page. That clears all registered methods and forces the user through registration at next sign-in. Then revoke sessions from the user's Overview page, so any token on the lost phone stops working.
- Entra admin center > Users > the user > Authentication methods.
- Delete the method for the lost device, or choose Require re-register multifactor authentication.
- Users > the user > Overview > Revoke sessions.
- If the user also had the phone enrolled in Intune, retire or wipe it from Devices.
Revoke-MgUserSignInSession -UserId jsmith@contoso.comA Temporary Access Pass gets them working in minutes
The problem with re-registration is that registering a new Authenticator requires signing in, and signing in requires MFA. A Temporary Access Pass (TAP) breaks that loop. It is a short code you generate that counts as strong authentication for a limited time, so the user can sign in, register the new phone, and carry on.
TAP must be enabled once in the tenant under Protection > Authentication methods > Policies > Temporary Access Pass. After that, create one per user from their Authentication methods page or with PowerShell. Use one-time and a short lifetime, read it to the user on the verified call, and tell them to register the new app immediately. The pass is recorded in the audit log, which is what you want.
New-MgUserAuthenticationTemporaryAccessPassMethod -UserId jsmith@contoso.com -IsUsableOnce:$true -LifetimeInMinutes 60Lockouts that are not lost phones
Not every MFA ticket is a lost device. A user who reports the MFA push "never arrives" often has notifications disabled for Authenticator, battery optimisation killing the app, or the phone on a network that blocks the push. Opening the app manually and approving from there works around it. A code-based method that is "always wrong" is a clock problem: the app has a Time correction for codes option under settings.
Entra ID also has smart lockout after repeated failed attempts, and a user who tapped Report suspicious activity or No, it's not me on a prompt can be blocked from signing in until an admin unblocks them under Protection > Multifactor authentication > Block/unblock users. Finally, check the sign-in log. A Conditional Access policy that requires a compliant device or blocks a country will show as an MFA failure to the user and as a policy failure to you.
Prevent the next one
Require at least two methods at registration: Authenticator plus a phone number, or Authenticator plus a FIDO2 key for anyone with elevated access. Turn on Authenticator's cloud backup on both iOS and Android so a phone replacement restores the accounts. Enable number matching and additional context so a push cannot be approved by accident, which also cuts the fraud-report lockouts.
And write the phone replacement into the joiners and leavers process. A user who gets a new phone with the old one still in hand can move Authenticator across in two minutes with no ticket at all. RackLedge includes this in the onboarding checklist for managed clients because it removes a whole category of urgent calls.
Frequently asked questions
Can the user reset their own MFA methods?
They can add and remove methods at aka.ms/mysecurityinfo, but only after signing in with a method they still have. That is why registering two methods matters: with only one, a lost phone always becomes a helpdesk ticket.
How long should a Temporary Access Pass last?
As short as practical. One hour and one-time use covers a verified call where the user registers immediately. Longer passes exist for new-starter onboarding, but keep them to a day and make sure they are used or expire.
What if the lost phone also had the corporate email on it?
Revoke sessions in Entra ID, then retire or wipe the device from Intune so the mail app and any cached data are removed. If the device was not enrolled, at least the token revocation stops the mail app from syncing again.
Takeaway
Treat an MFA reset as an identity event, not a technical one. Verify the caller properly, remove only the lost method, issue a short one-time Temporary Access Pass, and make the user register two methods before you close the ticket. Do that consistently and lost phones stop being emergencies.