MFA Reset.
KB Article 768 · Account Management · Self Service
Need to get a colleague back into their Microsoft 365 account because they’ve lost access to multi-factor authentication (MFA)? This guide walks you through how to raise an MFA reset through the MirrorSphere support portal, what to expect, and what the user needs to do once it’s done.
How it Works at a Glance
The MFA reset is automated — once approved, all of the user’s existing MFA methods are cleared and they’re prompted to register a new one the next time they sign in.
Portal form sent
Email with one click
Automatically
On next sign-in
- Approval received from your nominated approver, usually within minutes
- All existing MFA methods cleared automatically — no agent involvement
- You’re notified by email so you can let the user know to sign in
- User re-registers MFA at their next sign-in to Microsoft 365
How to Raise the Request
Step 1 — Raise the request
Sign in to the MirrorSphere support portal and choose MFA Reset from the request menu (or use the direct link your IT team has provided).
Fill in the form:
- User — from the user lookup, select the colleague who needs their MFA reset
- Justification — a short note explaining why, for example “User has a new phone and can no longer access the Authenticator app”
Once you submit the form, you’ll get a confirmation email letting you know the request is awaiting approval.
Step 2 — Wait for approval
An approver (usually a manager or senior team member) will receive an email asking them to approve or reject your request. You don’t need to do anything at this stage — just wait for the next notification.
Step 3 — Check the outcome
You’ll receive an email letting you know what happened:
- Complete — the MFA reset has already been done. Carry on to Step 4.
- Rejected — the request was declined. The email will explain why. If you think this is a mistake, contact your IT team directly.
Step 4 — Let the user know
Get in touch with the affected user (in person, by phone, or by Teams) and let them know:
- Their MFA has been reset
- They should sign in to login.microsoftonline.com as normal
- After entering their password, they’ll be prompted to set up a new MFA method — usually by installing or reconfiguring the Microsoft Authenticator app
- They should have their phone or authenticator device ready before signing in
Emails You Might Receive
Depending on how the request progresses, you may receive any of the following emails. The table below summarises the journey from submission to completion.
| When | What it means | |
|---|---|---|
| Pending Request Received | Immediately after you submit | Your request is in the queue for approval |
| Reminder Approval Pending | If review is taking longer than expected | A reminder has been sent to the approver on your behalf |
| Complete MFA Reset Done | Once the approver approves and the reset completes | The user’s MFA has been cleared — tell them to sign in and register a new method |
| Declined Request Declined | If the approver rejects | The reason will be in the email — speak to IT if you disagree |
Preview of each email
Sent immediately when you submit. Confirms your request has been logged and is waiting for the approver to review.
Sent once the approver approves and the reset completes automatically. This is your cue to let the user know their MFA has been cleared and they should sign in to register a new method.
What the User Needs to Do
Once you’ve let the user know, here’s what they should do:
- Install the Microsoft Authenticator app on their phone from the App Store or Google Play (if they don’t have it already)
- Sign in to login.microsoftonline.com with their email and password
- Follow the on-screen steps to register the Authenticator app (or another approved method)
- Once registered, they can sign in with MFA as normal
Important to Know
If Something Goes Wrong
Most MFA resets go through cleanly, but a few common scenarios are worth knowing about. Here’s how to handle them.
The approver’s reason will be included in the declined email. If you think this is a mistake, contact your IT team directly — don’t simply raise the same request again as it will likely be declined for the same reason.
A reminder is sent to the approver automatically if the request sits unactioned for too long. If it’s urgent, follow up with the approver directly, or call IT support on +44 (0) 1295 595 444 to arrange an alternative approver.
This usually means the device has a cached sign-in token. Ask them to sign out fully and sign back in — they should be prompted to set up MFA again. They can also go straight to mysignins.microsoft.com/security-info to add a method.
Raise both a password reset and an MFA reset request through the portal. The password reset will give you a one-time link to share, and the MFA reset will clear their authentication methods. Both are independent processes.
Frequently Asked Questions
Need More Help?
If this guide hasn’t resolved your issue, you have a few ways to reach us.
| Self-service portal | Raise a ticket via portal.mirrorsphere.com — the fastest route for non-urgent issues. |
| Phone support | +44 (0) 1295 595 444, Monday–Friday 08:30–17:30. For urgent issues outside these hours, leave a voicemail — the on-call team monitors it. |
| Urgent / locked out user | Call the support line above and quote “MFA lockout” so we route you to the right tech first. |
| Escalation | If the response time isn’t meeting your need, ask the agent to escalate to your account manager or your organisation’s Head of IT. |