TL;DR: How to add or reset your Microsoft 365 sign-in verification method (MFA)

The fix only. No explanation, no diagnosis. Read the full article if any of this does not match what you are seeing.

1. Still able to sign in: go to https://mysignins.microsoft.com/security-info, sign in, add the new method (Add sign-in method), then delete the old one.
2. Cannot sign in (lost phone): on the sign-in page choose another way to verify. If none works, ask your IT admin. You cannot reset it yourself.
3. Admin: verify who is asking first, by a route you already trust, not the one they contacted you on.
4. Admin: in https://entra.microsoft.com go to Entra ID, Users, the user, Authentication methods.
5. Option 1, Add authentication method, Temporary Access Pass (one-time use, short lifetime) for the user to register a new method. The TAP policy must be enabled first.
6. Option 2, Require re-register multifactor authentication, to wipe their phone, Authenticator and software token methods.
7. Then Revoke sessions, and have the user register the new method at https://mysignins.microsoft.com/security-info.
8. Check the method list and delete any old method still shown, such as a passkey.

A reset is the same thing an attacker is trying to get. Never reset on an email, chat message or phone call alone.

Pass the Temporary Access Pass to the user by a different channel than the request, and never put it in the ticket.

← Full article, with the diagnosis and the why