MFA keeps failing? Here's the real fix

Quick answer for advanced users: Check system time sync, clear authentication app cache, and re-register tokens. 90% of MFA failures are one of those three.

Let's be clear: MFA failing is almost never a "server outage" or "Microsoft broke something." It's almost always a local issue on your device or a configuration problem in your identity provider. I've walked into small businesses where three people couldn't log in for two days because nobody checked the clock. The time on their domain-joined laptops was off by four minutes. That's all it takes. Authenticator apps and hardware tokens check timestamps. If your device's clock is off by more than a minute, MFA will fail every time.

This happens most often after daylight saving time changes, or when a laptop hasn't been rebooted in weeks. I had a client last month whose entire sales team couldn't access their CRM because their laptops were syncing time to a domain controller that had its own CMOS battery fail. So let's fix this methodically.

Step 1: Sync your system clock

1. Windows: Open Settings > Time & Language > Date & time. Toggle "Set time automatically" off, wait 5 seconds, then toggle it back on. Then click "Sync now" under "Additional settings."
2. macOS: System Settings > General > Date & Time. Turn on "Set time and date automatically."
3. Linux: Run sudo timedatectl set-ntp true then sudo hwclock --systohc.
4. iPhone/iPad: Settings > General > Date & Time. Toggle "Set Automatically" off, then back on.
5. Android: Settings > System > Date & time. Enable "Use network-provided time."

After syncing, reboot the device. Then try MFA again. If that doesn't work, move to step 2.

Step 2: Clear the authenticator app cache

Authenticator apps cache tokens. When those tokens get stale, MFA fails silently. Here's how to clear them:

• Microsoft Authenticator: Open the app, tap the three dots (or gear icon), go to Settings > Diagnostics. Tap "View logs" then "Send all logs" (this resets app state). Or just uninstall and reinstall the app—that's faster.
• Google Authenticator: Open app > three dots > Settings > Time correction for codes > Sync now. It'll fix token timing. If still broken, remove and re-add the account.
• Duo Mobile: Open app > gear icon > Time sync > Sync. If that fails, delete the account and re-activate using the QR code from your admin.

I've seen Duo get stuck after an OS update. The fix is always to re-activate. It takes two minutes.

Step 3: Re-register your MFA device in your identity provider

If steps 1 and 2 don't fix it, the tokens stored on the server are out of sync with your device. You need to re-register.

1. Sign in to your identity provider (Microsoft 365, Azure AD, Okta, Duo Admin Panel, etc.).
2. Go to your security info or MFA settings.
3. Remove the existing authenticator app or hardware token.
4. Add a new one—scan the QR code with your app.
5. Test immediately.

For Microsoft 365/Azure AD: go to https://mysignins.microsoft.com/security-info, sign in, then remove your old authenticator app and add a new one. For Duo: log into the admin panel, find the user, and click "Reactivate Duo Mobile."

Alternative fixes if the main steps fail

Check Conditional Access policies

If you're using Azure AD or Okta, your admin might have a policy that blocks MFA from certain locations, devices, or IP ranges. Had a client who couldn't authenticate because their Conditional Access policy required MFA from a trusted location only—and their ISP changed their IP. The fix was to update the trusted IP range in the policy.

Try using a TOTP app instead of push notifications

Push notifications depend on network connectivity and app state. TOTP codes work offline. If your authenticator app supports both (Microsoft Authenticator does), switch to "One-time password" mode instead of "Approve" mode. You'll enter a code instead of tapping a button. It's more reliable, especially on slow networks.

Use a hardware security key

If you're still stuck, grab a YubiKey or similar FIDO2 key. They don't rely on time sync or app cache. Plug it in, tap it, you're in. I keep one in my laptop bag for emergencies. Worth every penny.

Prevention tips to avoid MFA failures

• Set up two MFA methods. Don't rely on a single authenticator app. Add a hardware key or backup phone number. When one fails, you have another.
• Check time sync monthly. Make sure all devices in your org sync to a reliable NTP server. For domain-joined machines, check that the PDC emulator has the right time. Fix that, and the whole network follows.
• Test MFA after every major OS update. Updates sometimes mess with time settings or app permissions. Test logging in with MFA right after an update, before you need it urgently.
• Don't share MFA tokens. I've seen people email themselves screenshots of QR codes. That defeats the purpose. Each user gets their own device or hardware key.

MFA failures are a pain, but they're almost always fixable in under ten minutes. Start with time sync, move to cache, then re-register. You'll be back in before your coffee gets cold.