How to manage and update your MFA recovery codes

Summary

This guide helps you troubleshoot and resolve: How to manage and update your MFA recovery codes. Follow the steps below to fix the issue.

Common Causes

Multi-Factor Authentication (MFA) adds a critical layer of security to your business accounts. However, if you lose your mobile phone or the authenticator app is deleted, you may be locked out of your account. Recovery codes serve as a "digital master key," allowing you to bypass the MFA prompt once to regain access and reset your security settings.

Generating Your Recovery Codes

It is essential to generate your recovery codes while you still have access to your primary MFA device. Follow these steps based on your primary account provider:

Microsoft 365 / Azure AD

1. Sign in to your My Account portal at myaccount.microsoft.com.
2. Select Security Info from the left-hand navigation menu.
3. Click Add sign-in method and select App code or Recovery code from the dropdown list.
4. Follow the prompts to generate your unique set of codes.
5. Click Print or Download to save these codes securely.

Google Workspace

1. Log into your Google Account and select Security from the left sidebar.
2. Under the How you sign in to Google section, click on 2-Step Verification.
3. Scroll down to Backup codes and select the arrow to enter the menu.
4. Click Get backup codes.
5. Save these codes to a secure location.

How to Use a Recovery Code

If you cannot access your MFA device, follow these steps to get back into your account:

1. Enter your email address and password on the login screen as usual.
2. When prompted for the MFA code or app approval, select I can't use my Microsoft Authenticator app right now or Try another way.
3. Select the option Use a backup code or Enter recovery code.
4. Enter one of your unused 8-12 digit codes into the field.
5. Once logged in, immediately navigate to your security settings to register your new device.

Managing and Updating Your Codes

To maintain a high level of security for your organisation, we recommend reviewing your recovery codes periodically.

When to rotate your codes

• If you suspect your printed or digital copy of the codes has been compromised.
• After an employee with access to these codes has left your business.
• Annually as part of a general security audit.

How to invalidate old codes

Generating a new set of recovery codes automatically invalidates all previously issued codes. To do this, simply return to the Backup codes or Security Info menu and select Get new codes or Regenerate codes.

Troubleshooting

The recovery code is not being accepted

• Check for typos: Ensure you aren't confusing the number 0 with the letter O or the number 1 with the letter I.
• Check usage: Confirm that the specific code you are using hasn't been used previously.
• Account Lockout: If you have entered the wrong code too many times, your account may be temporarily locked for security.

I have lost both my MFA device and my recovery codes

If you have no way to verify your identity, you will require an administrator to reset your MFA settings. If you are the sole administrator for your account, please Open a Ticket so our team can verify your identity and assist with a manual reset.

For issues related to local machine access, please refer to our guide on Password reset (Windows login).

Still Having Issues?