“Microsoft Authenticator not working” usually means one of three things: the approval notification never shows up, the six-digit code is rejected, or the app shows an error when you try to approve. Most come down to phone settings, not your account.
Two shortcuts help straight away: codes work offline, so you can pick the code option instead of waiting for a notification, and a missing notification often appears when you open Authenticator and refresh, because Microsoft holds some requests back.
An admin can reset a work or school account; a personal Microsoft account recovers through Microsoft’s own security pages. Either way, never turn off two-step verification or MFA to get around the app.
Try these first
- Open Authenticator and pull down on the account list, or tap Refresh, to see a waiting request.
- On the sign-in screen, choose to sign in another way and enter the code from the app.
- Set the phone’s date and time to automatic, then restart the phone.
- Update Authenticator from the App Store or Google Play.
- Turn off Focus or Do Not Disturb and make sure notifications are allowed for Authenticator.
- Switch between Wi-Fi and mobile data, disconnect any VPN on the phone, then try the sign-in again.
Match the symptom to the fix
| Symptom | Likely cause | What to do |
|---|---|---|
| No notification arrives | Notifications blocked, Focus or Do Not Disturb, Android battery optimization, no internet, or Microsoft held back an unusual sign-in | Open the app and refresh, then check the phone settings below |
| Every approval says it expired | The phone’s clock is wrong | Set date and time to automatic and restart |
| The app asks for a number you can’t see | Number matching: the number appears on the screen you’re signing in on, not on the phone | Type the number from the computer or browser into the app |
| The sign-in screen asks for Face, fingerprint, PIN or security key or shows a QR code | A registered passkey, which Microsoft asks for first | Scan with the phone’s camera, Bluetooth on for both devices, or choose Sign in another way |
| The six-digit code is rejected | Clock drift, the wrong account, a code already used, or an entry left over from an earlier registration | Fix the clock, check the account, then register again if needed |
| Enable push notifications to receive alerts or We could not complete the sign-in at this time. | Push notifications are off for the app, or there’s no network | Turn on notifications in the phone’s settings and retry |
| Authentication did not complete | A locked app, silenced notifications, an outdated app or a dropped network | Unlock Authenticator before you respond, update it, check the clock, switch networks |
| Something went wrong. [4s8qz] | Usually a temporary problem, such as an update in progress or a brief service interruption | Wait and retry, update Authenticator and restart; on work phones, also update Company Portal, then contact IT |
| Requests keep going to an old phone | The old device is still registered | See moving Authenticator to a new phone |
No notification? Work through the phone
Open the app before anything else
Since August 2023, Microsoft hasn’t sent notifications for sign-ins it rates as anomalous or that come from unfamiliar locations. The request still exists: open Authenticator, pull down on the account list or tap Refresh, and it appears. If you’re traveling or on a new network, this is the likeliest reason for Microsoft Authenticator not sending notifications.
iPhone
- In Settings > Notifications > Authenticator, make sure Allow Notifications is on.
- Check for an active Focus such as Do Not Disturb, Sleep or Work; turn it off to test, or allow Authenticator in that Focus.
Android
- Allow notifications for Authenticator in the phone’s app settings, and check Do Not Disturb.
- Turn off battery optimization for Authenticator, because aggressive power saving delays or drops notifications. Menu names vary by phone maker.
- For a work or school account, Google Play services and the Google Play Store must be installed and enabled.
Then the network and the account
Microsoft Authenticator notifications not showing, and no other app on the phone gets notifications either? Then the problem is the connection or Apple’s or Google’s notification service, not Authenticator: switch between Wi-Fi and mobile data, and disconnect any VPN. If only one account misses notifications, Microsoft’s fix is to remove that account and add it again with notifications allowed. For a work account, do that only if you can sign in another way.
Codes rejected or requests always expired
Authenticator code not working, or a Microsoft Authenticator notification expired before you could tap it? Check the phone’s clock first. Codes and approvals both depend on it, and Microsoft says it must be accurate; a clock that drifted or was set by hand makes codes fail and approvals expire.
- Set date and time to automatic, then restart the phone and confirm the time is right. On iPhone, that’s Settings > General > Date & Time > Set Automatically. On Android, look under the Date & time settings; the menu varies by phone maker.
- Read the code from the correct account. Names can look alike, and each code changes every 30 seconds, so type it before the countdown ends. A code also works only once, so if you sign in twice in quick succession, wait for the next one.
- Update the app. Microsoft says it doesn’t support Authenticator versions more than 12 months old, and a version too old for number matching can’t approve sign-ins at all. On a phone that can’t run a current version, Microsoft recommends signing in with a code from the app instead.
If codes still fail for just one work account, the entry may be left over from a registration your organization has since removed; set the app up again through Security info, described below. If codes fail for everyone, or nobody is offered the code option, check the policy rather than the phones: under Entra ID > Authentication methods > Policies > Microsoft Authenticator, users must be included under Enable and Target, and Allow use of Microsoft Authenticator OTP is the switch that permits codes from the app.
Number matching, passkeys, App Lock and other prompts
- Number matching. Every Authenticator push for a Microsoft 365 sign-in asks you to type the number shown on the screen you’re signing in on, and you can’t opt out. Exceptions: Outlook or Teams on the same phone may show a simple Yes or No, and some NPS-based VPN or Wi-Fi logins still show Approve or Deny. On iPhone, Show me the number again brings back a number that got covered. Apple Watch and Android watches can’t do number matching, so approve on the phone itself.
- Passkeys. Microsoft asks work and school users for the most secure method they’ve registered, so once you save a passkey in Authenticator, sign-in may ask for Face, fingerprint, PIN or security key instead of sending a notification. On a computer you then scan a QR code with the phone; on iPhone, use the Camera app, not Authenticator’s own scanner. Sign in another way gets you a notification instead.
- App Lock. With App Lock on, Authenticator asks for your phone PIN, face or fingerprint before you can approve, and a locked app can hide the box where you type the number. On a work profile, biometrics have to be added inside the work profile.
- Location. Requests can show a location based on the sign-in’s IP address. It can be approximate, so a nearby town, or a VPN’s or mobile carrier’s city, isn’t necessarily an attack.
Rather have a technician sort it out?
If Authenticator still won’t approve sign-ins after the phone checks, a technician can work through re-registration or a Temporary Access Pass with you remotely, provided someone in your organization has admin access. A GoProIT technician can connect remotely, with your permission, and fix it while you watch. $59 per fix, Mon–Fri 8am–8pm ET.
Work or school account: set Authenticator up again
- On the sign-in prompt, choose Sign in another way (it may read I can’t use my Microsoft Authenticator app right now) and use any other method you registered, such as a passkey or a text to your phone. As of October 2026, Microsoft plans to retire its own text and call codes for work accounts on February 1, 2027, so register a passkey when prompted.
- Open Security info at mysignins.microsoft.com/security-info, add Microsoft Authenticator again by scanning the QR code, approve the test request, and delete the broken entry.
If Authenticator was your only method, only an admin can get you back in. That’s intentional: a password alone shouldn’t be enough to attach a new phone to your account.
For admins: read the failure reason first
Confirm the request really comes from the user, for example by calling them back on a number you already hold. Then in the Microsoft Entra admin center open Entra ID > Monitoring & health > Sign-in logs, select the failed sign-in and check the reason on the Authentication Details tab. Entra ID Free keeps sign-in and audit logs for seven days, P1 or P2 for 30.
| Reason logged | What to do |
|---|---|
| user didn’t respond to mobile app notification | Work through the phone checks above |
| unable to send the mobile app notification to the device | Check notifications and connection, then delete that Authenticator entry and have the user register again |
| invalid mobile app verification code, or user entered incorrect code | Fix the phone’s clock and check the account; register again if it persists |
| user declined the authentication | Ask whether they started that sign-in; if not, treat the password as compromised |
To reset, open the user under Entra ID > Users > Authentication methods as at least an Authentication Administrator. A Temporary Access Pass is the safer route: the user signs in with it, registers Authenticator again and deletes the broken entry. If you instead delete the entry or choose Require re-register MFA, which deletes the user’s phone numbers, Authenticator apps and software OATH tokens, and no method is left, anyone who knows the password can register their own phone at the next sign-in, so have the user register straight away. Our guide to moving Authenticator to a new phone has the full steps and admin roles.
Don’t switch off MFA or security defaults to rescue one person, even briefly; the Temporary Access Pass exists so you never have to.
Personal Microsoft account: other ways back in
A personal Microsoft account, the kind used for Outlook.com, Xbox, OneDrive or Microsoft 365 Family, has no admin, so you fix it from your own security settings.
- On the sign-in prompt, pick another verification option, such as a code to your alternate email. Microsoft has been phasing out text-message codes for personal accounts, so a phone option may not appear.
- Once in, go to account.microsoft.com/security, select Manage how I sign in, then Add a new way to sign in or verify and Use an app to set Authenticator up again, then remove the old entry. Change one method at a time, because replacing all your security info at once can restrict the account for 30 days.
- If you saved a 25-digit recovery code, choose Other ways to sign in, Use my password, Forgot password?, Use a different verification option and I don’t have any of these, then enter it. With two-step verification on, changes take 30 days.
- With no method or recovery code left, follow Microsoft’s account recovery process in our Microsoft account locked guide; with two-step verification on, Microsoft warns you may lose the account.
Google, Amazon and other non-Microsoft accounts in the app get only codes, never push notifications. If their codes fail, fix the phone’s clock or use the backup codes that site gave you.
Approval requests you didn’t start
Treat an approval request you didn’t trigger as a sign that someone has your password, or, if you use passwordless phone sign-in, at least your username. Number matching helps you here: the number shows only on the screen where that sign-in started, so they can’t finish unless you type it in. Anyone who calls, texts or emails asking you for a sign-in number is attacking you, even if they say they’re from IT or Microsoft. Deny the request, then:
- Change your password right away from a device you trust.
- Work account: if Authenticator offers to report the request, report it. That flags your account as high risk for your admin, and your organization may then require a password reset. Tell your admin too, so they can check the sign-in logs and sign you out of all sessions.
- Personal account: review recent activity at account.microsoft.com/security and report sign-ins you don’t recognize.
Never approve a request just to make the alerts stop; repeated-prompt attacks rely on exactly that. For other warning signs, see how to tell if your business has been hacked.
When to stop and get help
- You’re the only Microsoft 365 admin and Authenticator was your only method. Nobody inside the company can reset you, so try every other option on the sign-in prompt, then Microsoft Support for business.
- Several staff stopped getting notifications on the same day. Look for a policy change, an app update or a Company Portal compliance issue instead of fixing phones one by one.
- The phone is jailbroken, rooted or too old to run a current version of Authenticator.
If you’d like a hand, re-registering one person’s Authenticator is a typical $59 remote fix, as long as they can still sign in another way or someone in your organization has admin access. You approve the session and can end it at any time. For a personal account with no working method left, no outside technician, us included, can get around Microsoft’s recovery process. Rolling out MFA and backup sign-in methods for the whole team is part of our email security and 2FA setup.
Common questions
Why am I not getting Microsoft Authenticator notifications?
The usual causes are notifications turned off for the app, a Focus or Do Not Disturb mode, Android battery saving, or no internet on the phone. Microsoft also skips notifications for sign-ins it considers unusual, such as from a new location, so the request only shows when you open the app and refresh. Fix the phone setting, then test with a fresh sign-in.
Why does Microsoft Authenticator say my code is wrong?
Codes are time-based, so a phone clock that’s even slightly off produces codes the server rejects. Set the date and time to automatic and restart the phone. Also check you’re reading the tile for the right account and typing the code before its 30-second countdown ends. If one work account still fails, its entry may be outdated and need registering again in Security info.
Can I use Microsoft Authenticator without internet?
Partly. Microsoft says the verification codes work without an internet or cellular connection, because they’re generated on the phone. Push notifications and approvals need a connection, both to receive the request and to send your answer back. So on a plane or in a basement, choose the option to enter a code on the sign-in screen and type the code shown in the app.
How do I reset Microsoft Authenticator for a work account?
If you can still sign in another way, open Security info at mysignins.microsoft.com, add Authenticator again and delete the old entry. If you can’t, your Microsoft 365 admin can require re-registration of your MFA methods or issue a Temporary Access Pass in the Microsoft Entra admin center. Either way you end up scanning a new QR code in the app.
Will reinstalling Microsoft Authenticator fix it?
Sometimes, but it’s a last step. Reinstalling removes the accounts on the phone, and work or school accounts don’t come back from a backup with their sign-in intact; you’d have to register them again. Before uninstalling, make sure you have another way to sign in to every account, or a working backup for personal and third-party ones. Updating the app fixes more problems with less risk.
How do I get a new QR code for Microsoft Authenticator?
The QR code comes from your account, not the app. For a work or school account, sign in at mysignins.microsoft.com/security-info, choose Add sign-in method, pick Microsoft Authenticator and select Next until the code appears, then tap + in the app, choose Work or school account and scan it. For a personal account, use Manage how I sign in at account.microsoft.com/security and choose Use an app. Locked out of a work account? Ask your admin for a Temporary Access Pass.