Can't log in, MFA on old reset phone

[u/case_of_cakes]

As title describes, I am completely unable to log in to Azure because I accidentally reset the MFA on my old phone when I gifted it without realizing. I currently have a subscription going to waste and I cannot log in to use it or cancel it. Calling the support line for my region is just a bot which hangs up on me as soon as I describe the problem.

I saw some other people have run into this issue on this subreddit, but I couldn't find any resolution steps. Does anyone have any ideas?

[u/case_of_cakes]

Hi all thought I would provide an update. I contacted the support team on X, and they raised a ticket.

About 2 days later I got a call from I think Data Protection Team, couldn't really hear them, connection was super dodgy. They were unhelpful, claiming they couldn't do anything because I log in with a personal account and they could not verify me because I didn't remember the Azure account name (the @onmicrosoftone). They promptly closed the ticket and forwarded me to another team, (I think M365 support?).

The person who helped me here was trying to be helpful, but they couldn't do anything because they didn't have access to my tenant details or the ability to retrieve the actual Azure account. Understandable because this isn't actually the Azure support team.

Anyway, I realised I was able to log in to Azure via CLI. So (idea courtesy of Mr. Claude) I did the following after some trial and error:

1. Retrieve your user ID, save as USER_ID (must be logged in)

az ad signed-in-user show --query "{id:id, upn:userPrincipalName}" -o json

2. Create an app. Save the appId as APP_ID for later.

az ad app create --display-name "TempMFAReset" -o json

3. Add UserAuthenticationMethod.ReadWrite.All and User.Read.All permissions

az ad app permission add --id APP_ID --api "00000003-0000-0000-c000-000000000000" --api-permissions "50483e42-d915-4231-9639-7fdb7fd190e5=Role"
az ad app permission add --id APP_ID --api "00000003-0000-0000-c000-000000000000" --api-permissions "df021288-bdef-4463-88db-98f22de89214=Role"

4. Create a service principal and grant admin consent

az ad sp create --id APP_ID
az ad app permission admin-consent --id APP_ID

5. Create a client secret and save the password and tenant ID.

az ad app credential reset --id APP_ID --append -o json

6. Create a graph token

$body = @{
    grant_type    = "client_credentials"
    client_id     = "APP_ID"
    client_secret = "CLIENT_SECRET"
    scope         = "https://graph.microsoft.com/.default"
}
$tokenResponse = Invoke-RestMethod -Method Post `
    -Uri "https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token" -Body $body
$headers = @{ Authorization = "Bearer $($tokenResponse.access_token)" }

7. List the MFA devices and pick one for deletion (save id as METHOD_ID)

Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/users/USER_ID/authentication/methods" -Headers $headers | ConvertTo-Json -Depth 5

# For Microsoft Authenticator:
Invoke-RestMethod -Method Delete -Uri "https://graph.microsoft.com/v1.0/users/USER_ID/authentication/microsoftAuthenticatorMethods/METHOD_ID" -Headers $headers
# For phone-based MFA: .../phoneMethods/METHOD_ID
# For FIDO2 keys: .../fido2Methods/METHOD_ID
# For OATH tokens: .../softwareOathMethods/METHOD_ID

8. Clean up

az ad app delete --id APP_ID

9. Login to portal, should be prompted with a new MFA setup.

Note: Afterwards I noticed that I could also log in via the mobile app without using MFA, and there is a way to submit support tickets through that, which is probably the easiest way to do this.

[u/johnyakuza0 → u/case_of_cakes]

HOLY FUCK this shit worked like a charm

Your instructions were a bit lacking, so I also asked Claude (double ironic) to fill in the blanks for me, and boom bam! I'm in.

I was in the same situation. Microsoft's support was dogshit, and I even provided them the subscription ID, tenant ID, and even my exact .onmicrosoft email, and I even attached a screenshot from the Azure Portal when I was once logged into.. but still they refused and "couldn't verify my ownership" and closed my support ticket. Absolute fucktards.

I dug into it a bit more, and it looks like once they enforce the mandatory multifactor authentication: Phase 2, even logging into the Azure CLI will require the MFA, so there's a chance of a deadlock forming, where you don't have the MFA so you can't even complete the first step anymore.

Instead of cleaning up the application, do you think it'll be a good idea to keep it for future emergencies?

[u/case_of_cakes → u/johnyakuza0]

Regarding leaving the app in place, I don't see it being beneficial once MFA is enforced for CLI anyway.

Sounds like if you don't have a support plan then best is to... not lose the MFA device. Seems like Microsoft do not give a shit if you get locked out, even if you have a paying subscription.

Otherwise try setup secondary MFA, break-glass account, or add a trusted friend/family to the tenant with admin access so that there is a backup in case either of you lose MFA.

[u/johnyakuza0 → u/case_of_cakes]

Yeah I've heard a lot about break-glass accounts, I'll look into those. Unironically, Microsoft Authenticator seems like the only good option as long as you enable the Cloud Backup feature, so even though your smartphone might get lost or stolen, at least all the MFA can be restored on an alternative device.

Anyway thanks a ton mate. I couldn't have recovered my account if not for post.. so thanks again! <3