![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(80, 95%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EL%3C/text%3E%3C/svg%3E)
Microsoft Security | Microsoft Identity Manager
A tool for managing user identities, credentials, and access across on-premises and cloud environments
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(208, 52%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERE%3C/text%3E%3C/svg%3E)
Hi @LindaL ,
The 6-digit vs. 8-digit mismatch actually tells us exactly what's wrong. An 8-digit code means that entry in Authenticator is registered to your personal Microsoft account. A 6-digit code request means the sign-in is being verified against a separate MFA registration inside your Azure (Entra) tenant. That tenant-side registration is stale, probably pointing at an old phone or app install, which is also why the approval requests never arrive. Your personal account itself is fine. The broken piece is the MFA registration for that account inside your tenant.
That's also why your tickets keep getting closed. They were routed as a personal account MFA problem, which that team correctly can't handle. Your case is actually a tenant admin lockout, which is a different process entirely. Since you are the only Global Administrator, this falls under a tenant lockout scenario that Microsoft's Data Protection / Tenant Recovery team resolves after verifying ownership.
What to do:
- Quick check first: on the verification screen, click "Sign in another way" or "I can't use my Microsoft Authenticator app right now" and see if any other method is listed (email, for example). If one works, sign in, go to aka.ms/mfasetup, delete the stale method, and re-register Authenticator. Done.
- If no other method exists, open a new support case, but frame it precisely like this: "Microsoft Entra ID tenant lockout. The sole Global Administrator cannot complete MFA because the tenant-side registration is stale. Requesting MFA / security info reset for this admin account at the tenant level via the Data Protection / Tenant Recovery process." Include your tenant ID or default .onmicrosoft.com domain, custom domain, subscription ID and billing details. You can also call the regional number from the Microsoft customer service phone numbers page, state it's an MFA lockout for an Azure tenant's only Global Administrator, and ask for escalation to Data Protection / Tenant Recovery. The proof of domain ownership and billing information you mentioned is exactly what they verify.
- Once they reset it, you'll be prompted to set up MFA from scratch at next sign-in, and this time the registration will be created correctly for the tenant. Then immediately add a second Global Administrator (your business account as an invited guest, or a dedicated emergency access account) so one broken registration can never lock the whole tenant again.
On your transfer question: there is no supported way to transfer a tenant to another account. And every alternative (adding your business account as admin, or moving the subscription to your business tenant) requires a working admin sign-in first. So recovery has to happen either way. After you're back in, adding your business account as Global Admin gets you the same practical outcome.