Locked out of account with 2-step verification and still signed in on old device

If you're locked out of your Microsoft Outlook account and unable to complete the sign-in or recovery process due to two-step verification issues, here are some steps you can take:

1. Use Other Verification Options: Since you still have access to the phone number associated with your account, try selecting Other verification options when prompted during the sign-in process. This might allow you to receive a verification code via SMS.
2. Check Phone Number Settings: Ensure that the phone number linked to your account is correct. You can ask another global admin to verify this if you have access to one.
3. Contact Support: Since you mentioned that the Account Recovery Form (ACSR) is not usable due to two-step verification, you may need to contact Microsoft support directly. If you're part of a company tenant, reach out to your organization's global admin for assistance. If you are the only global admin, you can contact the Azure Data Protection team for help.
4. Emergency Access Account: If you have set up an emergency access account (also known as a break-glass account) in Microsoft Entra, you can use it to regain access. This account is designed to help prevent lockouts.
5. Wait and Retry: If you are receiving the message about requesting too many codes, it may be necessary to wait for a longer period before trying again. Microsoft may have rate limits on how often you can request verification codes.
6. Escalation: If none of the above steps work, you can ask for escalation by contacting Microsoft support and explaining your situation, including your access to the Outlook app on your old device.

Unfortunately, without the ability to reset your password or access security settings, your options are limited. It's crucial to reach out to Microsoft support for further assistance.

Hi I can imagine how frustrating and stressful this situation must feel being locked out of your account while still having access on an old device can make it seem like the solution should be simple yet the system keeps blocking you.

To get back into your Microsoft account try signing in with any method other than SMS to avoid rate limits. If you saved your 25character recovery code use it to bypass the Authenticator. If nothing works start the 30day security info replacement process since ACSR won’t override twostep verification. If your old device still has Authenticator approve a sign-in and add backup methods if it only has Outlook you’ll need the replacement process. For ongoing SMS issues report them to Microsoft. After recovery add multiple verification options and keep your recovery code safe to prevent future lockouts.

On your old phone do you still have the Microsoft Authenticator app installed and generating codes for this account or is it only the Outlook app that remains signed in?

Best regards

Lucky Charm

Hello,

I am still locked out of my Microsoft Outlook account and I am stuck in a loop where I cannot complete sign-in or recovery.

Here is my situation:

• I have two-step verification enabled, but I lost access to the Microsoft Authenticator app that was set up on my old device.
• I still have access to the phone number on the account and I receive the SMS verification codes, but when I try to sign in, I get the message: “You’ve requested too many codes”, even if I wait several days between attempts.
• The Account Recovery Form (ACSR) rejects my request and says it cannot be used because two-step verification is turned on.
• However, I am still signed in on my old phone in the Outlook app and I can still read all of my emails, folders, and inbox content from that device. I just cannot access the account security settings or reset my password because it requires the missing second authentication method.
• I have tried all recommended steps (waiting 24–48 hours and longer, using a trusted device, using home WiFi, trying different browsers), but I remain blocked in this loop.

I am not asking to bypass security.

I am asking for help with an escalation since I still have an active session on a trusted device and ownership can be verified through that.

Could a Microsoft moderator please help escalate this for a higher-level identity verification review? I can confirm any details needed about my account, mailbox content, folder names, or the trusted device where I am still signed in.

Thank you,