{"componentChunkName":"component---src-templates-post-tsx","path":"/authenticator-qr-code-unexpected-error/","result":{"data":{"logo":{"childImageSharp":{"fixed":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAACXBIWXMAAGwGAABsBgFnvUbqAAAC5UlEQVQ4y5WUT0gUcRTHvzuzS+scNg9Z2Epjiwdhy13/0BzWDTx1jYKIQCMU2VYQPC9SeNgg7KIdklhYPHRQhBA8SOAKHcJsRRfRU9BNTFHapXB3/jx548wyrqPVgzfvNzO/9/l9f+/3B/iL+Xw+Dh77fWNjw/lbWFhYwD9bXV0d9vf37dcHAD56vd7PAD4AiNlQn8/ncQ7qaqIoOpWlFUWh2dlZyufzNDMzQy0tLQTgmTOHiE4aHo+Z5xEEQXRARCvea29vJ03TdCKq7OzsaLlcrry1tUWNjY1HABQAVwFcqwJd5IqyLAtWO5vJZIhh/BgbGzNYzN7enj46OkqyLBdTqdRPRVF+AAiaNbASeaQ3AGSrfmJzczM3Py0tLTFLIyLj4OCAVldXDf4wMTGhDw4OsnJKJpOs9rqtKCBJ0vf+/n5qaGj4BeChQ+3bqakpzlHL5TI5zOD+6XSaFhcXSZKkdz09PdWkF4lEgjv9WV9fp6amJi7GfQASgGQoFKLd3V1WYlQq5syNzc1NCgQCh9Fo9Gt9ff1rAJeqW83v9xfW1tbsaWnLy8usVGtrazuMx+OlYDCoTU5OmiBLpTY/P8+DfmFAKBQ6tRY3w+FwWdfNUhiaxkzSi8UilUolYgC7qqpm3QzjJPCjs7NTA3CrZlcgGo/HzU66rhtsNpzBVrRhZlRV1Qx9fX2s8nEtMBKLxU4BOc/NbYWWWm1kZISBiVrgjdbW1t9WbapAN7O/2wp7e3sZ+KgWKHi93m8rKytmsSuVSpXoppBnwc7tSCTCNQzbHOfJSFnb5oihnMAqeGo1zkeQYUdzc3OsLsfJXV1dZy6Gy4IgbA8NDVGhUCBrMXi51Ro3T0sul7Mvh7tu6mz6FQAv/X7/dnd3Nw0PD/PRounpacpmszQ+Pk4DAwPU0dGhA8gDeHLOPXDmI+/4OwCeW2c7A+A9gFcAngK4fU7emfvP41ypi8y6pkT8hwlWgpsLF2UeA2cncRiRWBqkAAAAAElFTkSuQmCC","width":400,"height":400,"src":"/static/c145ae02d8428dda1fa96de2fe8a40ed/497c6/rubber-duck-logo.png","srcSet":"/static/c145ae02d8428dda1fa96de2fe8a40ed/497c6/rubber-duck-logo.png 1x,\n/static/c145ae02d8428dda1fa96de2fe8a40ed/2a4de/rubber-duck-logo.png 1.5x,\n/static/c145ae02d8428dda1fa96de2fe8a40ed/ee604/rubber-duck-logo.png 2x"}}},"markdownRemark":{"html":"

Introduction

\n

While onboarding a brand new user to a tenant, the Microsoft Authenticator app refused to register the account, even though other users on the same tenant were registering without any issue. This post captures the symptoms and the fix so future-me (and you) don’t have to spend a week on a support ticket to find it.

\n

The setup and issue

\n

The flow that failed was a textbook first-time MFA setup:

\n
    \n
  1. New user is created in Microsoft Entra ID.
    2. \n
  2. User signs in to https://login.microsoftonline.com with the temporary password.
    3. \n
  3. User sets a new password.
    4. \n
  4. User is prompted to set up MFA and chooses Work or school account in Microsoft Authenticator.
    5. \n
  5. User scans the QR code.
    6. \n
\n

At step 5, the Authenticator app fails with:

\n
Unable to add account.\nUnexpected error. Please contact your local IT administrator to resolve the problem.
\n

Things worth noting:

\n\n

So the failure was clearly local to the Authenticator app’s state on that one device, not a tenant or account issue.

\n

The solution

\n

The fix turned out to be a single, low-key option inside the Authenticator app:

\n

Authenticator app → Settings → Device Registration → Reset Device Notifications.

\n

After triggering Reset Device Notifications, the QR code scan completed and the account was added on the first try.

\n

Why it works

\n

When you add a work or school account, the Authenticator app must complete two things behind the scenes:

\n
    \n
  1. Register the app/device with Microsoft Entra ID.
    2. \n
  2. Establish a push notification channel (via FCM on Android / APNs on iOS) so MFA prompts can be delivered.
    3. \n
\n

If the local notification registration state is stale or inconsistent - for example after OS updates, app updates, restoring from backup, or partially failed previous registrations - the registration handshake can fail and surface as the generic “Unexpected error”.

\n

Reset Device Notifications clears that local state and forces the app to re-establish a fresh notification registration, which unblocks the new account add.

\n

Conclusion

\n

If you ever hit “Unable to add account. Unexpected error.” in Microsoft Authenticator and the tenant side looks healthy, try Reset Device Notifications before going down the rabbit hole of factory resets or new devices. Hope this saves you some time.

","htmlAst":{"type":"root","children":[{"type":"element","tagName":"h2","properties":{},"children":[{"type":"text","value":"Introduction"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"While onboarding a brand new user to a tenant, the Microsoft Authenticator app refused to register the account, even though other users on the same tenant were registering without any issue. This post captures the symptoms and the fix so future-me (and you) don’t have to spend a week on a support ticket to find it."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h2","properties":{},"children":[{"type":"text","value":"The setup and issue"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The flow that failed was a textbook first-time MFA setup:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"ol","properties":{},"children":[{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"New user is created in Microsoft Entra ID."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"User signs in to "},{"type":"element","tagName":"code","properties":{"className":["language-text"]},"children":[{"type":"text","value":"https://login.microsoftonline.com"}]},{"type":"text","value":" with the temporary password."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"User sets a new password."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"User is prompted to set up MFA and chooses "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Work or school account"}]},{"type":"text","value":" in Microsoft Authenticator."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"User scans the QR code."}]},{"type":"text","value":"\n"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"At step 5, the Authenticator app fails with:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"div","properties":{"className":["gatsby-highlight"],"dataLanguage":"plaintext"},"children":[{"type":"element","tagName":"pre","properties":{"className":["language-plaintext"]},"children":[{"type":"element","tagName":"code","properties":{"className":["language-plaintext"]},"children":[{"type":"text","value":"Unable to add account.\nUnexpected error. Please contact your local IT administrator to resolve the problem."}]}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"Things worth noting:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"ul","properties":{},"children":[{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"Other (existing and newly created) users could add their accounts to Authenticator on different devices without any problem."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"The same Authenticator app on the affected device already had other work accounts registered and was working fine."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"The tenant configuration, Conditional Access, and user state all looked healthy."}]},{"type":"text","value":"\n"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"So the failure was clearly local to the "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Authenticator app’s state on that one device"}]},{"type":"text","value":", not a tenant or account issue."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h2","properties":{},"children":[{"type":"text","value":"The solution"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"The fix turned out to be a single, low-key option inside the Authenticator app:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Authenticator app → Settings → Device Registration → Reset Device Notifications."}]}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"After triggering "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Reset Device Notifications"}]},{"type":"text","value":", the QR code scan completed and the account was added on the first try."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h2","properties":{},"children":[{"type":"text","value":"Why it works"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"When you add a work or school account, the Authenticator app must complete two things behind the scenes:"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"ol","properties":{},"children":[{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"Register the app/device with Microsoft Entra ID."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"li","properties":{},"children":[{"type":"text","value":"Establish a push notification channel (via FCM on Android / APNs on iOS) so MFA prompts can be delivered."}]},{"type":"text","value":"\n"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"If the local notification registration state is stale or inconsistent - for example after OS updates, app updates, restoring from backup, or partially failed previous registrations - the registration handshake can fail and surface as the generic “Unexpected error”."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Reset Device Notifications"}]},{"type":"text","value":" clears that local state and forces the app to re-establish a fresh notification registration, which unblocks the new account add."}]},{"type":"text","value":"\n"},{"type":"element","tagName":"h2","properties":{},"children":[{"type":"text","value":"Conclusion"}]},{"type":"text","value":"\n"},{"type":"element","tagName":"p","properties":{},"children":[{"type":"text","value":"If you ever hit “Unable to add account. Unexpected error.” in Microsoft Authenticator and the tenant side looks healthy, try "},{"type":"element","tagName":"strong","properties":{},"children":[{"type":"text","value":"Reset Device Notifications"}]},{"type":"text","value":" before going down the rabbit hole of factory resets or new devices. Hope this saves you some time."}]}],"data":{"quirksMode":false}},"excerpt":"Introduction While onboarding a brand new user to a tenant, the Microsoft Authenticator app refused to register the account, even though…","timeToRead":2,"frontmatter":{"title":"Microsoft Authenticator - \"Unexpected error\" when scanning QR code","userDate":"8 June 2026","date":"2026-06-08T10:00:00.000Z","tags":["Azure","All"],"image":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAA7EAAAOxAGVKw4bAAABPElEQVQoz51STUvDQBDNH1EE0f/ixUNBDx68iPgPxJMeRBDvetJDvegh4C9Il9KSlFqVojfbxTY5mCi4tEW36e4+SUhKEtMPfDDM7Ozj8WZ2NeRABaFUWMsoBxBSjRkq0U9CG4tEhCDHtYiy0/dhuTwlmuTlCmaFY2c/I4mdCsPK2RNKzfewNxIqxZ0qmCYqHDUH2Hr8RuHqHgsbt3imX5nx53AYuyt2fazXOQ494OD1A8t7N1gqFMEGwz/7zRUM9xI7VBIvPYFj6mPT6GJ19wKLayc4vbbAhyIgpfY+c4dJnN/Vsb1/iZb9iVl8Le+SMQZd12EQgodGA9UygWVVUSkTGCUCq1aDaZoQQkx2mPwGnHNQSuE4DmzbRqvdhut6eOt0wnPQ9zwPUsr/jTwNc40cvrSUqcj21IRH+QWoYUlTgLcl5gAAAABJRU5ErkJggg==","aspectRatio":1.7777777777777777,"src":"/static/8c50714632df32567934e833296a71e6/f3dec/banner.png","srcSet":"/static/8c50714632df32567934e833296a71e6/f3dec/banner.png 640w","sizes":"(max-width: 640px) 100vw, 640px"}}},"author":{"id":"Dushyant","bio":"Check about page for details.","avatar":{"children":[{"__typename":"ImageSharp","fixed":{"base64":"data:image/jpeg;base64,/9j/2wBDABALDA4MChAODQ4SERATGCgaGBYWGDEjJR0oOjM9PDkzODdASFxOQERXRTc4UG1RV19iZ2hnPk1xeXBkeFxlZ2P/2wBDARESEhgVGC8aGi9jQjhCY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2P/wgARCAATABQDASIAAhEBAxEB/8QAGAABAQEBAQAAAAAAAAAAAAAAAAQCBQH/xAAXAQEBAQEAAAAAAAAAAAAAAAABAwIE/9oADAMBAAIQAxAAAAGC3Hg4dQPBrOiN41P/xAAbEAACAwEBAQAAAAAAAAAAAAABAgADESEEMv/aAAgBAQABBQIKRNBq0TQi+b7LV7vahFHP/8QAGBEAAgMAAAAAAAAAAAAAAAAAABEBAhD/2gAIAQMBAT8BcIZbP//EABcRAAMBAAAAAAAAAAAAAAAAAAEQEQL/2gAIAQIBAT8Bhqyv/8QAHBAAAgICAwAAAAAAAAAAAAAAAREAMQIQICIy/9oACAEBAAY/AqiONaIbc7VPA4f/xAAdEAEAAwABBQAAAAAAAAAAAAABABEhQRAxYYGx/9oACAEBAAE/ISLx5jZEdCHbpcbDiA1R+4TQeoJQwLgOif/aAAwDAQACAAMAAAAQJC8+/8QAGBEBAQEBAQAAAAAAAAAAAAAAAQAhMXH/2gAIAQMBAT8QC8WtG5i//8QAGREAAgMBAAAAAAAAAAAAAAAAADEBESGR/9oACAECAQE/EOwWUOSz/8QAHxABAQACAQQDAAAAAAAAAAAAAREAIVExQWGBcaHB/9oACAEBAAE/ECCZsaWvrF6FZ3RLvhvTLdbfkf3Eo1h5d9n16yVHiJb7nfJTRa5HOsQildYEIbMrqbmf/9k=","width":400,"height":388,"src":"/static/ca50b870313d79772bec7be9f9d9786f/64b17/dp-profile.jpg","srcSet":"/static/ca50b870313d79772bec7be9f9d9786f/64b17/dp-profile.jpg 1x,\n/static/ca50b870313d79772bec7be9f9d9786f/39f27/dp-profile.jpg 1.5x,\n/static/ca50b870313d79772bec7be9f9d9786f/a1eb1/dp-profile.jpg 2x"}}]}}}},"relatedPosts":{"totalCount":20,"edges":[{"node":{"id":"6b238ef5-97a6-52b3-9e05-bdd521b92904","timeToRead":1,"excerpt":"ARM Template Deploying resources to Azure using ARM templates is generally quite easy given Azure’s native support in the generation of the…","frontmatter":{"title":"ARM deployment - Cannot find ServerFarm"},"fields":{"slug":"/arm-serverfarm-not-found/"}}},{"node":{"id":"9be15455-1c5a-5267-a7a1-e5af59d4ecbe","timeToRead":2,"excerpt":"Introduction It is quite useful to know the outbound IP address of an Azure function app or an app service. Both these services are the same…","frontmatter":{"title":"Finding the outbound IP address of an azure function/webapp"},"fields":{"slug":"/app-outbound-ip/"}}},{"node":{"id":"e455f307-50ba-520a-8093-a1709b0f957d","timeToRead":2,"excerpt":"Introduction While onboarding a brand new user to a tenant, the Microsoft Authenticator app refused to register the account, even though…","frontmatter":{"title":"Microsoft Authenticator - \"Unexpected error\" when scanning QR code"},"fields":{"slug":"/authenticator-qr-code-unexpected-error/"}}}]}},"pageContext":{"slug":"/authenticator-qr-code-unexpected-error/","prev":{"excerpt":"Introduction I ran into a small but frustrating issue recently. Git was telling me my branch was ahead of origin by a couple of commits…","timeToRead":1,"frontmatter":{"title":"When git reset --hard Isn’t Enough","tags":["Git","All"],"date":"2026-06-05T00:00:00.000Z","draft":false,"image":{"childImageSharp":{"fluid":{"aspectRatio":3.858921161825726,"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAFCAYAAABFA8wzAAAACXBIWXMAAB7CAAAewgFu0HU+AAABR0lEQVQY01WQS0sCYRSG5y+17w/0CwqDFm2jKIiiRUgtuhEhmJC7LouIIKILuSiCsshuCDneqCzUCnUmR78Z5xt1njDC6izPed8HzqMANLIZxMoCrmXyd16e4pyf7JJKRpFaAScVw6w3MNIJKtlXLOmQv75AlD/RCgXSdzcozv0Vxmg/IjBLZckLUnIc2sI/P8L2ho+gbwLvmIdKNoMRCSOaLsVIGD2pIqRD/GCHqlbiI58jEjpEaYG0rg7MtQD6UC+kVALLk0yNdnO0u8r0uAffzCBVs4JRsykLk/fwKXr8AcOq4fx849TryHoDxW02MYOLlAd6sI73v4/+uWEG+joJ7a2TeVSJ3p6hFT/aKiwh0HUdIQSJnU2MUpFCsYS0bZRWoOXOid23C2+5Z2LRS6Ss/XPqus1fqGVhCkEpqVI1yti2/b3/Aib0YLDxunSOAAAAAElFTkSuQmCC","sizes":"(max-width: 1714px) 100vw, 1714px","src":"/static/7a97243ee77e0f2af80f705cae4fd15e/6ab48/git_banner.png","srcSet":"/static/7a97243ee77e0f2af80f705cae4fd15e/c5c6c/git_banner.png 930w,\n/static/7a97243ee77e0f2af80f705cae4fd15e/6ab48/git_banner.png 1714w"}}},"author":{"id":"Dushyant","bio":"Check about page for details.","avatar":{"children":[{"fixed":{"src":"/static/ca50b870313d79772bec7be9f9d9786f/64b17/dp-profile.jpg"}}]}}},"fields":{"layout":"post","slug":"/git-reset-not-enough/"}},"next":null,"primaryTag":"Azure"}},"staticQueryHashes":["3100086437","794779027","990608418"]}