Help a staff member who cannot sign in to Microsoft 365

When a staff member cannot sign in to Microsoft 365, you can often fix it yourself in the IT Solver dashboard. You can reset their password, block or allow sign-in, or make them set up multi-factor authentication (MFA) again.

This article is about Microsoft 365 sign-in. If you cannot sign in to the IT Solver dashboard, read Fix problems signing in to the dashboard.

Signs that you need this

• The staff member forgot their password.
• Microsoft says the password is incorrect, or the account is disabled or locked.
• The staff member got a new phone, and Microsoft still sends the sign-in request to the old phone.
• The staff member deleted the Authenticator app, or changed their phone number.
• In the dashboard, the person shows Sign-in blocked.
• The account was renamed, and the old sign-in email does not work.

Before you start

• You must have the Owner or IT manager role for your business in the dashboard. See What each dashboard role can do.
• Your Microsoft 365 must be connected to the dashboard. If the dashboard shows Finish Microsoft setup before resetting passwords., do the setup steps on the page that opens, then try again. See Connect the dashboard to your Microsoft 365.
• Make sure that the person who asks is really your staff member. If you are not sure, call them on a phone number that you already have.

Find the person

1. Sign in at dashboard.itsolver.net.
2. In the sidebar, select Microsoft 365.
3. Select the People tab.
4. Find the person in the list. Select the actions button (...) at the end of their row.

Reset a forgotten password

1. In the actions menu, select Reset password.
2. Keep They forgot it or need a new one selected. Only the password changes.
3. Keep Ask user to change password on sign-in selected. The staff member then chooses their own password when they sign in.
4. To type a password yourself, select Set a specific password, then type it in Password. It must have at least 8 characters. Microsoft can also reject a password that is too simple. If the dashboard shows an error, use a longer password with letters, numbers and symbols, or clear Set a specific password to get a temporary password. If you clear Ask user to change password on sign-in, the staff member can keep this password.
5. Select Reset password.
6. The dashboard shows the temporary password one time only. Copy it now. If you typed the password yourself, the dashboard shows that password instead.
7. Give the password to the staff member by phone or in person. Do not send it to the email account that they cannot open.

Each computer and phone that uses the account asks for the new password one time.

Block sign-in for a while

Use this when a staff member must not use the account for a while, for example during leave. The password does not change.

1. In the actions menu, select Block sign-in.
2. Confirm the message. The person shows Sign-in blocked.

A computer or phone that is already signed in can keep access for up to an hour. To sign the person out now, use Secure account instead. If the person has left your business, read When a staff member leaves: offboard them in Microsoft 365.

Allow sign-in again

If the person shows Sign-in blocked, somebody blocked the account (see Block sign-in for a while). A blocked account cannot sign in, even with the correct password.

1. In the actions menu, select Allow sign-in.
2. Confirm the message. The password does not change.
3. Wait a minute, then refresh the page. Microsoft can take a minute to show the new status.

If Microsoft says that the account is locked because of too many wrong passwords, contact IT Solver.

The sign-in email changed

When you rename an account, the person signs in with the new sign-in email. The old address stays on the account as an alias for email, but the person cannot use it to sign in.

1. In People, find the account and check the email address under the name.
2. Tell the person to sign in with that address.
3. If Reset password was selected when you renamed the account, give the person the temporary password from the rename result. If it was not selected, the person uses their old password.
4. If Require MFA setup was selected when you renamed the account, the person must set up MFA again.
5. If you cleared Reset password or Require MFA setup during the rename, and the account now belongs to a new staff member, do those steps now. See Reset a forgotten password and Make the person set up MFA again.

For the full steps, read Rename a Microsoft 365 user or hand their account to someone else.

Make the person set up MFA again

Use this when the person has a new phone, lost their phone, or deleted the Authenticator app.

1. In the actions menu, select Require MFA setup.
2. Confirm the message. The dashboard removes the person's current MFA methods immediately.
3. Read the result. MFA setup required again means that the methods were removed. No existing setup found means that the person had no MFA methods to remove. Needs review means that some methods could not be removed. Select Require MFA setup again. If it still shows Needs review, contact IT Solver.
4. Wait about 5 minutes. Microsoft can take up to 5 minutes to stop asking for the old MFA methods.
5. Tell the person to sign in again. When Microsoft next asks for MFA, it asks them to set it up again on their new phone.

If the person uses Windows Hello (PIN or face sign-in), they must set it up again on each computer.

Someone else may have access

Use this if the person clicked a fake sign-in link, lost a phone, or sees sign-in requests that they did not start.

1. In the actions menu, select Secure account.
2. Keep Someone else may have access selected.
3. Keep Sign out of every device and app and Remove sign-in methods (MFA) selected.
4. If nobody must use the account until you check it, select Also block sign-in. Then nobody can sign in until you select Allow sign-in.
5. Keep Ask user to change password on sign-in selected. The staff member then chooses their own password when they sign in.
6. Select Reset and secure account.
7. Copy the new password. The dashboard shows it one time only.
8. Read the Steps list. If a step failed, do that step again from the actions menu.
9. If you blocked sign-in, select Allow sign-in from the actions menu when the account is safe. See Allow sign-in again.

Microsoft can take a few minutes to sign the account out of all apps, and up to 5 minutes to stop asking for the old MFA methods. Attackers can also add mail forwarding or inbox rules. Ask IT Solver to check the mailbox.

If the account no longer belongs to anyone, read When a staff member leaves: offboard them in Microsoft 365.

The person cannot set up MFA

Sometimes Microsoft asks for MFA before the person can set up a new method, for example when they have no phone with them. IT Solver can create a Temporary Access Pass. The pass lets the person sign in and set up MFA, and it stops working after 8 hours. Ask IT Solver for one.

The person is in another country

Your Microsoft 365 can block sign-in from some countries. If the person travels and the correct password does not work, read Check your Microsoft 365 sign-in protection (Conditional Access).

Examples

A staff member came back from leave and forgot the password

The person types the password three times, and Microsoft says it is incorrect.

To fix it: do the steps in Reset a forgotten password. Read the temporary password to the person on the phone. They choose their own password when they sign in.

A staff member got a new phone

The person moved to a new phone. Microsoft still sends the Authenticator request to the old phone, which is reset.

To fix it: do the steps in Make the person set up MFA again. Wait about 5 minutes. Then the person signs in and sets up the Authenticator app on the new phone.

The account was blocked when the person went on leave

The person returns to work. The dashboard shows Sign-in blocked next to their name.

To fix it: do the steps in Allow sign-in again. If you also changed the password before the leave, reset the password and give the new password to the person.

A staff member entered the password on a fake page

The person clicked a link in an email and typed their Microsoft password. Now they get sign-in requests that they did not start.

To fix it: immediately do the steps in Someone else may have access. Tell the person not to approve sign-in requests that they did not start.

A new staff member took over a past staff member's account

You renamed the account for the new person. The new person types the old email address, and Microsoft does not find the account.

To fix it: do the steps in The sign-in email changed. The new person signs in with the new address.

Still have a problem?

Questions? Email support@itsolver.net or phone 07 3123 6000.

Include the person's email address, the time they tried to sign in, and a screenshot of the error message.