Microsoft Authenticator is two products wearing one icon. One of them pushes a request to your phone and asks you to approve it. The other shows a six-digit code that counts down and expects you to type it. They fail for completely different reasons, and almost every troubleshooting page for this treats them as the same thing.
So before anything else, work out which one is failing. The general case — any app, any service — is in 2FA code not working: causes and fixes, in order. This page is the Microsoft-specific half, and its siblings are Google Authenticator code not working and Authy code not working.
The short answer
If a notification is the problem, it is a network, notification or version problem, and the number you are being shown is not optional. If a six-digit code is the problem, it is a clock or an entry problem and nothing to do with notifications at all. If the account is a work or school account, a third possibility opens up: your organisation controls which methods you may use, and a restore may have brought back the account name without the credential behind it.
Which one is actually failing
Two quick tests settle it.
The approval side needs a live connection. The sign-in page sends a request, your phone has to receive it, and you have to answer it before the server stops waiting. No notification, a delayed notification or a timed-out one is a failure of that round trip, not of any secret.
The code side needs nothing but the clock. A six-digit one-time password is computed from the stored secret and the current time, with no network in the loop. It is refused only when the two sides disagree about what time it is, or about what the secret is.
So: put the phone in aeroplane mode. If the code still appears, the app is fine and the code side is working as designed. If you were waiting on a push approval, aeroplane mode is exactly the problem.
Push approvals: the number is not optional any more
If you expected a plain Approve button and got a request for a two-digit number instead, nothing is broken. For work and school accounts in Microsoft Entra ID, Microsoft states flatly that "Number matching is enabled for all Authenticator push notifications", and describes the flow: "When users respond to an MFA push notification by using Authenticator, they see a number. They need to enter that number into the app to complete the approval" (Microsoft Learn).
Three consequences of that are worth knowing before you spend an afternoon on it:
- There is no setting to turn it off. Microsoft's own FAQ: "No, users can't opt out of number matching in Authenticator push notifications."
- An old app version simply fails. "If a user runs an older version of Authenticator that doesn't support number matching, authentication won't work. They need to upgrade to the latest version of Authenticator to use it for sign-in." If sign-in broke and nothing else changed, check the app version before anything else.
- Wearables are out. Microsoft says number matching is not supported for push notifications on Apple Watch or Android wearables, and that those users need to approve on their phone instead.
One more thing that confuses people into thinking the behaviour is inconsistent: on the same device, signing in to a Microsoft mobile app can show a plain Yes or No rather than a number, while a browser sign-in on that same phone still asks for the number. Microsoft documents both as intended, because the prompt only appears on the device that started the sign-in.
Six-digit codes: the clock first, then the entry
If it is the code that is being refused, the order is the ordinary one. Turn on automatic date and time in the phone's own settings, generate a fresh code, and type it straight away rather than submitting one with four seconds left on it.
If automatic time was already on, the clock is not the cause, and you are into the entry itself: an account that was enrolled a second time somewhere and left a dead entry behind, two accounts at one provider with near-identical labels, or a verifier whose acceptance window is narrower than you assumed. Those are worked through in the causes that survive a correct clock.
Work and school accounts fail in ways you cannot fix from the phone
A work or school account is not yours to configure. Which methods are allowed, whether push is permitted at all, and whether a code may be used instead are decided by your organisation's policy, so a method that worked last month can stop being offered without anything changing on your phone. The same applies in reverse: if the app shows a work account with no one-time password line under it, the account is registered for push rather than for codes, and there is no code to find.
That is the point at which the fastest route is your IT or service desk, not another reinstall.
After a restore: what the backup actually brought back
This is the one that sends people in circles, because the restored app looks complete. Microsoft's backup documentation is explicit about what each kind of account gets back.
| Account type | What the backup restores |
|---|---|
| Personal Microsoft account using a one-time password code | The codes come back and work |
| Third-party account using a one-time password code | The codes come back and work |
| Personal Microsoft account with passwordless sign-in | The account name only |
| Work or school account | The account name only |
For the last two rows Microsoft's wording is the same sentence both times: "Only the account name is backed up. When you restore, you will need to sign in again."
So a restored list that contains your work account is not evidence that the credential came back with it. You sign in to that account again, or your organisation issues a new QR code. Microsoft also notes the codes for a personal account can differ between the old phone and the new one after recovery, with each valid on its own device.
Two other limits from the same page. Backups do not cross platforms: "You can only backup and restore on the same device type: accounts backed up using an iOS device cannot be restored on an Android device." And the Android backup mechanism is changing — "Starting January 2027, you will no longer use your Microsoft personal account to enable backup. You will need to enable 'Microsoft Authenticator' from Google One backup" (Microsoft). If you are on Android and planning a phone change, read Microsoft's current article rather than an older walkthrough. The step-by-step for a move is in Moving Microsoft Authenticator to a new phone.
When nothing in the app will work
At some point this stops being a troubleshooting problem: the secret you hold is not the secret the service holds, or the account is registered for a method you can no longer complete. Retrying does not change either.
Spend a backup code if the service issues them, look for a second factor you forgot you had — a browser still signed in is often enough to register a new method — and only then start the provider's recovery process. Lost your phone? How to get your authenticator codes back has the per-service routes, and Where to store your 2FA backup codes is how you avoid arriving here again.
Where KeyNesta fits, and what it cannot do
Be clear about the boundary: KeyNesta has no push approvals. Push sign-in is a feature of the Microsoft Authenticator app talking to Microsoft's servers, not a secret any other app can hold, so if your account is registered for push there is nothing for KeyNesta to import and nothing it can approve. Where Microsoft offers a standard authenticator-app option, that one is an ordinary TOTP entry and behaves like any other.
KeyNesta also cannot read a Microsoft Authenticator backup. Microsoft Authenticator does not export the secrets behind its codes and its cloud backup restores only into itself, so moving means re-enrolling each account at its own service in an order that never leaves you locked out — Can I import from Microsoft Authenticator? sets out that order, and KeyNesta vs Microsoft Authenticator is the honest comparison, gaps included.
What it does do is keep codes working without a network and without a phone number, and keep a synced vault you can open on another device when a phone goes missing.
Frequently asked questions
Why does Microsoft Authenticator ask me to type a number instead of tapping Approve?
Because number matching is on for all Authenticator push notifications on work and school accounts, and Microsoft says users cannot opt out of it. The number shown on the sign-in screen has to be entered in the app to complete the approval, which is what stops an accidental tap approving somebody else's sign-in attempt.
Why is there no code under my work account in Microsoft Authenticator?
That account is almost certainly registered for push approval rather than for a one-time password code, so there is no code to show. Which methods are available is set by your organisation's policy, not by the app, so the route to changing it is your IT or service desk.
Why do my codes differ between my old phone and my new one after a restore?
Microsoft notes that after recovery the codes for a personal account can differ between the old and new phones, and that each is valid on its own device. Use the one on the phone you are actually signing in with, rather than assuming the mismatch means the restore failed.
Can Microsoft Authenticator produce codes with no network connection?
The six-digit codes, yes: they are computed from the stored secret and the clock, so they appear in aeroplane mode. Push approvals, no. A request has to reach the phone and your answer has to get back before the server stops waiting, so no connection means no approval.
Does Microsoft Authenticator work on an Apple Watch?
No. Microsoft removed the watchOS companion app, saying it was incompatible with Authenticator's security features, and separately that number matching is not supported for push notifications on Apple Watch or Android wearables. Approvals have to be completed on the phone.
Takeaway
Decide first which half of the app is failing, because the two have no causes in common. A missing or timed-out approval is a notification and version problem, and the number you are asked for is not something you can switch off. A refused six-digit code is a clock problem first and an entry problem second. And if a restore left you with an account that is listed but will not authenticate, read what the backup actually promised for that account type: for work, school and passwordless accounts, the answer is the name and nothing else.