Error 500121: How to Fix Microsoft Authenticator MFA Sign-In Failure (8 Fixes)

Microsoft Authenticator error 500121 can block your login even after you enter the correct password. You complete the first step, but the MFA verification suddenly fails leaving you locked out of Microsoft 365, Entra ID, or critical work apps.

In most cases, this error is not a server issue. It happens due to time sync problems, blocked accounts, or broken MFA setups. In some cases the Authenticator app shows nothing at all: no push notification arrives and no number match screen appears, leaving you with no way to complete the MFA step. However you can fix it in minutes using the exact steps below.

What Is Microsoft Authenticator Error 500121?

When you see error 500121, the authentication handshake between your device and Microsoft’s servers failed after your password was accepted. The error screen shows:

• Error Code: 500121
• Request ID – save this if you contact Microsoft Support
• Correlation ID – save this if you contact Microsoft Support
• Timestamp of the failed attempt

Important: Error 500121 is almost never caused by a Microsoft server outage. It is a client-side or policy problem you can fix yourself in most cases. Verify Microsoft service health at status.office.com to rule out an outage first.

Why Does Error 500121 Happen?

8 Fixes for Microsoft Authenticator Error 500121

Work through these in order. Fixes 1 and 2 resolve the issue for most users.

Fix 1: Sync Your Device Time (Most Common Fix)

Error 500121 is most often caused by clock drift. Microsoft Authenticator uses time-based one-time passwords (TOTP) with a 30-second validity window. If your phone’s clock is even 60 seconds off, every code you generate will be rejected.

On Android:

1. Go to Settings → General management → Date and time
2. Enable Automatic date and time and Automatic time zone
3. Restart your device

On iOS (iPhone / iPad):

1. Go to Settings → General → Date & Time
2. Enable Set Automatically
3. Restart your device

Quick test (Android only): Open Microsoft Authenticator → tap your account → tap Correct time for codes → Sync now. The app will flag any detected drift immediately.

After syncing, retry sign-in before moving to the next fix.

Fix 2: Remove and Re-Add Your Account in Authenticator

Re-registering refreshes the shared MFA secret between your device and Microsoft. This resolves most persistent 500121 errors that time sync alone does not fix.

If you recently changed your Microsoft account email address or your organisation changed your domain, the Authenticator app is still linked to your old address (UPN mismatch). Removing and re-adding the account with the new email corrects this immediately.

Warning: Do not remove the account from Authenticator until you confirm access to mysignins.microsoft.com via an alternate method (SMS, email, or a trusted PC).

1. On a PC or trusted device, sign in to mysignins.microsoft.com/security-info using an alternate method such as SMS
2. Remove the existing Authenticator entry
3. Select Add sign-in method → Authenticator app
4. Open Microsoft Authenticator on your phone
5. Tap Add account and scan the new QR code

Fix 3: Unblock the User Account – Admins Only

Tapping “Not me” during an MFA push notification triggers Microsoft’s Fraud Alert or Report Suspicious Activity feature, which can automatically block the account. Standard MFA resets will not fix this until the block is lifted.

To unblock via Microsoft Entra Admin Center:

1. Go to entra.microsoft.com
2. Navigate to Protection → Multifactor Authentication → Block/unblock users
3. Find the affected user and click Unblock

To unblock via Microsoft 365 Admin Center:

1. Go to admin.microsoft.com
2. Navigate to Users → Active users and select the affected user
3. Click Unblock sign-in, uncheck Block this user from signing in, and save

Note: Deleting authentication methods and issuing Temporary Access Passes will keep failing if the underlying block is not cleared first. This is the most commonly missed step in persistent 500121 cases.

Fix 4: Diagnose With Entra Sign-In Logs – Admins Only

Before making any policy changes, read the sign-in logs to find the precise failure reason. This prevents guesswork and reveals Conditional Access or Identity Protection blocks immediately.

1. Open entra.microsoft.com
2. Go to Monitoring & Health → Sign-in logs
3. Filter by: Sign-in error code: 500121 and the affected Username
4. Open the failed sign-in entry and read the Failure reason field

Common failure reasons you will see:

Detailed sign-in log filtering requires Microsoft Entra ID P1 or higher. The Report Reader role is the minimum role required to access this data.

Fix 5: Review Conditional Access Policies – Admins Only

If sign-in logs show a Conditional Access or Identity Protection block, review and temporarily adjust the relevant policy:

1. In Entra Admin Center, go to Protection → Conditional Access → Policies
2. Identify the policy blocking the user (the sign-in log will name it)
3. Check if the block is due to: device non-compliance, non-approved network location, or a High risk sign-in score from Identity Protection
4. Temporarily exclude the affected user, or issue a Temporary Access Pass (TAP) so they can re-register MFA from a trusted location

Geographic location note: If users in your tenant are accidentally tapping “Not me” because the location shown in the MFA push looks unfamiliar, go to Security → Authentication Methods → Policies and review the Show geographic location in push notifications setting. The location shown may not match the user’s exact city, which causes false fraud reports.

Fix 6: Reset MFA Registration – Admins Only

Use this when the user is partially locked out and can still complete some form of authentication (e.g., SMS).

1. In Entra Admin Center, go to Users → All users and select the affected account
2. Click Authentication methods
3. Click Require re-register multifactor authentication
4. On the user’s next sign-in, they will be prompted to set up MFA from scratch

If the user cannot complete any authentication method at all, generate a Temporary Access Pass (TAP):

1. In the user’s Authentication methods panel, click Add authentication method → Temporary Access Pass
2. Set an appropriate validity window (e.g., 1 hour)
3. Provide the TAP to the user – they use it in place of MFA for one session to re-register

Fix 7: Use Alternate MFA Methods (SMS or Phone Call)

If your organisation has alternate verification methods configured and the Authenticator app is failing:

1. During sign-in, click Other ways to sign in or I can’t use my Microsoft Authenticator app right now
2. Choose Text a code or Call my phone
3. Complete sign-in, then visit mysignins.microsoft.com/security-info to fix the Authenticator registration

Best practice: Always register at least two MFA methods (Authenticator app + SMS) so one is always available as a fallback.

Fix 8: Update or Reinstall Microsoft Authenticator

An outdated or corrupted Authenticator app can silently fail to generate or deliver MFA codes without displaying any obvious error.

1. Open the Play Store (Android) or App Store (iOS) and search for Microsoft Authenticator
2. Tap Update if available
3. If the update does not help, uninstall the app completely and reinstall it
4. Re-add your account using a fresh QR code from the Security Info page (see Fix 2)

Warning: Uninstalling Authenticator removes all accounts stored in the app. Confirm you have an alternate MFA method or backup codes before uninstalling.

Browser-Specific 500121 Issues

If MFA prompts fail only in a web browser during Microsoft 365 sign-in:

1. Clear browser cache and cookies: Settings → Privacy → Clear browsing data
2. Confirm JavaScript is enabled in your browser
3. Disable ad blockers or script-blocking extensions temporarily
4. Avoid private/incognito mode – Microsoft’s MFA flow depends on session cookies
5. Try a different browser (Edge, Chrome, Firefox) to isolate the problem

If You Are the Only Administrator

Being the sole admin with error 500121 is a serious lockout scenario. Try these steps in order:

1. Sign in from a previously trusted device or network – Microsoft may skip the full MFA challenge for a known device
2. Use any backup MFA method already on the account (SMS, backup email, FIDO2 hardware key)
3. Use a Temporary Access Pass (TAP) if one was previously configured
4. Contact Microsoft Support at support.microsoft.com and request tenant recovery. Have ready:
   • Error code: 500121
   • Request ID (from the error screen)
   • Correlation ID (from the error screen)
   • Timestamp of the failed sign-in
   • Your company name and billing details
   • An alternate email address for identity verification

When you call, select business account then technical support. Ask to be transferred to the Data Protection Team directly and explain you are the sole administrator locked out of your tenant. The Data Protection Team is the only team authorised to manually reset MFA for a sole admin account. Do not accept a redirect to general support – only the Data Protection Team can action this request.

5. Create a second emergency admin account in Entra ID. Configure it with a hardware FIDO2 key and a separate backup email MFA. Store credentials securely – use it only in break-glass scenarios like this one.

Quick-Reference: Match Your Situation to the Right Fix

How to Prevent Error 500121 From Returning

• Keep Microsoft Authenticator updated automatically – enable auto-updates on your phone
• Always register at least two MFA methods on every account
• Keep your phone’s date and time set to automatic
• Never tap “Not me” unless you are certain the prompt is fraudulent – doing so triggers an Identity Protection block
• If you deny a prompt due to suspected phishing, report it to your IT admin immediately so they can review the sign-in log and clear any resulting block
• Create and store backup MFA codes via Security Info before you need them
• For organisations: create at least one break-glass emergency admin account protected with a hardware FIDO2 key

Related Microsoft Authenticator Error Codes

FAQs

Related Guides

• How to Secure Your Microsoft 365 Account Against Data Theft Attacks
• How to Set Up a Passkey for Your Microsoft Account and Remove SMS Authentication
• Can’t Sign In to Microsoft Azure Account? 7 Fixes That Work