What you’re seeing
- The user's old phone is gone, broken or reset, and the new one has no Authenticator account set up.
- The sign-in page keeps asking to approve a prompt on a device the user no longer has.
- Codes from a newly installed Authenticator app are rejected.
- The user is locked out of email, Teams and other apps until MFA is sorted out.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- Authenticator registrations are tied to the specific device and were not transferred or backed up before switching phones.
- The user's only registered MFA method was the old phone, with no backup phone number or alternate method.
- Self-service MFA re-registration isn't available because it requires the very MFA the user has lost.
- A phone number on file is outdated, so SMS or voice fallback goes nowhere.
Why it matters
A locked-out user can't work until their identity is verified and MFA is re-registered. If handled carelessly, the recovery process becomes a security hole: attackers specifically impersonate employees who "lost their phone" to trick help desks into resetting MFA. A proper identity check and a clean re-registration protect both productivity and the account.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
How do you know it's really our employee asking?
We follow an identity verification step agreed with your organization before resetting anything, because fake lost-phone requests are a common attack.
Can we avoid this next time someone changes phones?
Yes. Registering a second method or backup ensures users can recover themselves. We can explain sensible options for your team.