Locked out of Microsoft 365? What it means, and the safe way back in

Endless approval prompts. Microsoft's security defaults, which are switched on for new accounts and can be switched on for older ones, require every user to register for a second step and show a number on the sign-in screen that you type into the Microsoft Authenticator app. Microsoft describes that number as the measure that stops people falling for "MFA fatigue" attacks. Since August 2023 an unusual sign-in does not send a notification at all: you open Authenticator, pull down to refresh, and approve there. So "no prompt arrived" often means "open the app and refresh". A true loop, where you approve and are asked again, can come from an old setup. Microsoft notes that Exchange Online accounts created before 2017 have modern authentication off by default and can loop. That is a setting for an administrator, not something to fix by trying harder.

A prompt you did not start. If a sign-in prompt arrives when you are not signing in, someone else has your password. Do not approve it. Deny it, and use the report option in Authenticator: Microsoft records a user who reports a suspicious prompt as high risk, and the report shows in the sign-in logs as "MFA denied". Then change the password and read the page on a hacked mailbox, linked below.

A replaced or lost phone. The Authenticator app is tied to a phone. Microsoft says a passkey kept in Authenticator is device-bound and never leaves the device it was made on, so a new phone does not inherit it. If the old phone still works, add the new phone at your account's Security info page before you wipe the old one. If the old phone is gone, only an administrator can fix it: an Authentication Administrator can require you to register again, which deletes your old phone numbers, Authenticator apps and software tokens and asks you to set up a new method at the next sign-in, or can issue a Temporary Access Pass, a time-limited code that Microsoft describes as making recovery easier when a strong method is lost. The same page says an administrator cannot issue one for themselves, so a lost admin phone needs a second administrator.

"Your organization requires more information", or a screen asking you to set up a second step. This is usually the sign-in asking you to register, because security defaults or a policy require it. The wording varies, so read it carefully. Microsoft removed the 14-day registration grace period for new and existing accounts from July 29, 2024, and a brand new account has a 24-hour grace period. Type Microsoft's address yourself rather than following a link in an email, and do not enter a code that someone sends you.

A licence that ended, so Outlook is read-only. For a business subscription Microsoft describes four states: active, expired, disabled and deleted. For most offers in most countries, expired lasts 30 days and disabled lasts 90, though agreements differ. In expired, everyone still has normal access. In disabled, users cannot use Microsoft 365, the apps eventually drop to a read-only mode with unlicensed-product notices, and only administrators can reach the data. A global or billing administrator can reactivate the subscription in both states. Once it is deleted it cannot be reactivated, and Microsoft says a new subscription of the same type does not bring the data back. Do not buy a replacement and assume the old mailboxes will return.

The only administrator left, or nobody can administer the account. Resetting a password or a phone needs an administrator. By default, the person who created the account holds the Global Administrator role. If that person left, find out first whether a second administrator exists. If an unmanaged account was created on your domain by someone who signed up with a work address, Microsoft documents a takeover: you prove you own the domain with a DNS TXT record at the registrar, and either become the administrator of that account or move the domain into one you already manage. That second route does not work for plans that include SharePoint or OneDrive. If the account was bought through GoDaddy, Microsoft's own page sends you to GoDaddy's documentation and support for the release, and warns that unofficial steps can break sign-in to the mailbox and SharePoint.

A shared mailbox that stopped opening. A shared mailbox is not meant to be signed in to directly. Microsoft says to keep the sign-in for its account blocked, and people open it through their own licensed mailbox. Three limits cause most surprises: 50 GB without a licence, and at the limit it can still receive for a while but cannot send, then stops receiving; at most 25 people; and a new permission can take about an hour to replicate, during which you may see an error that you lack permission to send as that address.

A lockout is almost never fixed by trying harder. It is fixed by finding which of the three parts failed: the password, the second step, or the account itself.

Setting up Microsoft 365 or moving mail into it is a different job, covered on the Microsoft 365 setup and migration page