Azure wants 6 digits code but Authenticator generates 8 digits

This is a sole-Global-Administrator tenant lockout, so contact Microsoft business support without signing in and request escalation to the Data Protection/Tenant Recovery team for ownership verification and restoration of administrative access.^1^

Open the recovery case

1. Open Microsoft’s public support page and select the business/technical-support route for your country or region: ^2^
2. State the following clearly:
   • Microsoft Entra tenant lockout
   • Only Global Administrator
   • No usable alternate administrator or authentication method
   • Authenticator was reinstalled and the work-account MFA registration is unavailable
   • Azure requests a six-digit verification code, but no valid six-digit OATH code is available
   • Request escalation to Data Protection/Tenant Recovery
3. Provide a reachable external email address and telephone number. Follow the support representative’s tenant-ownership verification process.
4. Record the support case number. If initially routed to consumer account support, clarify that this concerns a Microsoft Entra work or school tenant, not a personal Microsoft account.

Comparable cases with the same sole-admin, six-versus-eight-digit symptom were resolved by opening a support ticket and engaging the Data Protection team.^3^

Do not publish tenant IDs, subscription IDs, domains, billing information, or administrator addresses in a public Q&A post.

Why reinstalling Authenticator did not restore access

The values involved are not interchangeable:

• A six-digit field expects an OATH verification code generated by a correctly registered Authenticator software token.^4^
• Number matching is a push-notification flow: the sign-in page displays a number that is entered into the Authenticator approval notification.^5^
• Authenticator backup does not restore work or school account credentials; it restores only the account name, after which the account must be signed in and registered again.^6^

Therefore, the displayed eight-digit value should not be entered into the six-digit field. Since reinstalling the app removed the usable work-account registration and no other administrator can reset MFA, further app reinstalls will not resolve the lockout.

After access is restored

1. Re-register Authenticator and verify that both notification approval and verification-code sign-in work.
2. Add another independent authentication method.
3. Create at least two emergency-access administrator accounts with distinct credentials and authentication methods. Microsoft recommends two or more emergency-access accounts specifically to reduce the impact of MFA or administrator lockouts.^7^
4. Exclude the designated emergency-access accounts from Conditional Access policies that could otherwise lock out every administrator, while monitoring those accounts closely.^8^

References

1. Sole Global Admin locked out of Entra ID tenant — Authenticator MFA loop / tenant lockout - Microsoft Q&A
2. Contact Microsoft customer support
3. Azure wants 6 digits code but Authenticator generates 8 digits - Microsoft Q&A
4. Authentication methods in Microsoft Entra ID - Microsoft Authenticator app
5. How number matching works in MFA push notifications for Authenticator - Authentication methods policy
6. Restore one-time password codes in Microsoft Authenticator | Microsoft Support
7. Manage emergency access accounts in Microsoft Entra ID
8. Require MFA for administrators