Was stumpted on this one and had to get advice from Microsoft Support.
A single user couldn’t log in via Multi-Factor Authentication. SMS code would say it was sent, wouldn’t come through. Phone call also wouldn’t come through. Trying to set up another MFA method aka.ms/mfasetup would receive one of these errors:
You are blocked from performing this operation. Please contact your administrator for help.
We’re sorry, we ran into a problem. Please select “Next to try again.
There were zero search results for that first error word for word, which is never a good sign.
There’s several areas you can check for blocked users such as:
But I couldn’t find the user listed in any of those.
After logging a case, Microsoft Support advised to check here:
And of course, that’s where the user was listed. They’d had some suspicious activity (a MFA phone call they didn’t initiate) so chose the option to block future sign in attempts, as you’d hope. This also triggered an email alert to admins, and that link is where the user’s block is listed until released.
3 thoughts on “User Can’t Receive MFA Requests for Azure AD / Microsoft 365”
Really useful article. Many thanks for posting.
This saved my sanity!!!!!!! Thank you!
Aside from Global Admin, what roles are required to allow a helpdesk the ability to unblock users from the https://portal.azure.com/#view/Microsoft_AAD_IAM/MultifactorAuthenticationMenuBlade/~/BlockedUsers blade? I can’t seem to find any documentation.