Password · guide

Microsoft Authenticator app not working, and why the clock comes first

By Alberto Gulotta · Updated 10 September 2026 · 15 min read

With the microsoft authenticator app not working, start with the phone’s clock: set date and time to automatic, then restart. That single setting decides whether a six-digit code is accepted, because the code is not sent to your phone — it is calculated there, from the time.

What the app is doing when it fails, by symptom
What you see	What is actually happening	Where to go first	Source
The code is refused every time	The phone’s clock and the service’s clock disagree, so the two are computing different codes for the same moment	Date & time, set to automatic	Microsoft, RFC 6238
“Notifications always expired”	Same cause, stated by Microsoft as its own heading: the app “requires your mobile device clock to accurately report your local time”	Set the clock to automatic, then restart	Microsoft
No prompt arrives at all	Notifications blocked, Do Not Disturb, or battery optimisation stopping the sync	Settings, Notification Settings; turn off battery optimisation	Microsoft
Your saved passwords have gone	Not a fault. The feature was withdrawn	Nothing to fix here — see below	Microsoft
An old version simply stops	“Microsoft does not support any app versions more than 12 months old”	Update the app	Microsoft

This is the whole reason the clock instruction is not a superstition. The code is a calculation done in two places at once, and time is one of the two inputs.

Set the phone’s date and time to automatic. This is first because it is the only cause that makes correct-looking codes wrong. Microsoft: “Authenticator requires your mobile device clock to accurately report your local time. If your device clock is set to manual, reconfigure your system clock to automatic.”
Then restart the phone, and check the time again. Microsoft adds the second half in the same breath: “after updating your clock, restart your device and make sure the new time is set correctly.” A clock that reverts is a different problem, usually a dead backup battery or a manual time zone.
Update the app. There is a hard limit: “Microsoft does not support any app versions more than 12 months old.” A phone that has not taken updates for a year has an app that is out of support rather than broken.
Turn off battery optimisation for Authenticator. Microsoft’s own tip: “tap Settings and select Turn off battery optimization for better sync performance.” This is the usual explanation for prompts that arrive late or only when you open the app.
Check notifications are on, in two places. In the app — “tap Settings > Notification Settings and make sure Show notifications is turned on” — and in the phone’s own settings. Do Not Disturb counts as off.
Swap the network, then disconnect any VPN. Microsoft again: “if you’re using mobile data, try switching to Wi-Fi and vice-versa”, and “if you’re using VPN, try disconnecting to see if the issue persists”.
If you are locked out rather than inconvenienced, stop and use a recovery route. Backup codes, a second registered method, or your organisation’s help desk. Reinstalling the app to fix a sign-in you cannot complete removes the accounts it is holding.

All five are Microsoft’s own advice. The order is ours, and it follows the symptom: only the first one makes a correct-looking code wrong.

What the app stopped doing, and when

Before troubleshooting a fault, it is worth knowing whether you are looking at one. Microsoft states this on the same page as the fixes, in a note rather than a heading.

Autofill and stored passwords were removed on a schedule Microsoft’s wording: “starting July 2025, the autofill feature in Authenticator will stop working, and from August 2025, passwords will no longer be accessible in Authenticator.” If what stopped is your list of saved passwords, no setting on the phone brings it back, and the export route is the one to look for instead.

The codes and the approval prompts were not part of that The second-factor side of the app carried on. So a report of “not working” splits cleanly in two: passwords, which are gone by decision, and codes, which fail for the reasons above. Treating the first as a fault means chasing a setting that no longer exists.

And there is a version cliff, stated as a rule “Microsoft does not support any app versions more than 12 months old.” That is a sentence with teeth: a phone that stopped taking updates has an app that will stop working on a timetable, and the symptom will look like a sudden failure rather than an expiry.

Both dates are Microsoft’s, printed on its own troubleshooting page. Half of “the app stopped working” is a product decision with a date on it.

When it is a work account, the causes are different

Codes that never arrive may be a block rather than a delivery problem. On its page for work and school accounts, Microsoft lists as a first possibility that “you may be blocked due to unusual activity”, and gives the instruction that goes with it: “don’t make excessive or repetitive requests to alternative emails or phone numbers as this can cause us to block you and not send verification codes.” Asking again is the thing that makes it worse.

Some of it is geography and the handset, not the app. Microsoft names two more causes in its own words: “if you’re in a region where Microsoft’s SMS services have limited functionality or are temporarily unavailable, this could prevent the code from being delivered”, and “if your phone’s message inbox is full or if you’re using a messaging app that’s malfunctioning, the verification SMS might fail to appear.” There is one more cause with a different remedy: codes that stop arriving because the number itself was moved to somebody else’s SIM, which is a SIM swap and is the reason regulators treat a text message as the weakest second factor. None of those is fixed by reinstalling anything.

And the reinstall is the move to avoid while you are locked out. Removing the app removes the accounts registered in it. If you cannot complete a sign-in, the way back is a backup code, a second registered method, or the help desk — in that order — and only then a clean reinstall with the accounts added again.

Why the clock instruction sounds like folklore and is not. Every troubleshooting list puts “check your date and time” near the top, and it reads like the technical equivalent of turning it off and on again. The reason it works is written in the specification the codes are built on. RFC 6238 defines a time-based one-time password as a calculation whose inputs are a shared secret and the clock — which is also why a code made this way can never arrive by itself, the way an unrequested text code can: the party generating the code “MUST know or be able to derive the current Unix time”, and the interval is a system parameter whose default the document states as “X = 30 seconds”. Nothing is transmitted. Both ends do the same arithmetic and compare answers, so a clock that is wrong by more than a minute produces answers that are right for a moment that is not this one.

Which is also why the fix has to include a restart. Microsoft pairs the two instructions deliberately — set the clock to automatic, then “restart your device and make sure the new time is set correctly”. Applications hold on to a time offset they read at start-up, and a phone that has been running for weeks on a manual clock may not pick up the correction immediately. If the time reverts after the restart, the problem has moved: it is a time zone set by hand, a network that supplies no time, or hardware.

The prompts that arrive late are a different family. A code refused and a prompt that never appears have nothing in common except the app. Prompts are push notifications, so they depend on the notification channel, on the app being allowed to run in the background, and on the phone not being in a mode that silences it. Microsoft’s three instructions cover exactly those: turn off battery optimisation for the app, turn on Show notifications inside the app’s own settings, and check the phone is not in Do Not Disturb. Its network advice belongs here too: swap between mobile data and Wi-Fi, and disconnect any VPN.

The one to be careful about is the reinstall. It is the reflex fix for a misbehaving app and it is the wrong one here, because the accounts registered in an authenticator live in the app and not in the account. Removing it while you are already unable to sign in turns an annoyance into a lockout. If a code is being refused, the clock is free to try and costs nothing. If nothing at all works, the route back is whatever second method was registered when the account was set up — which is the argument for printing backup codes on the day you turn any of this on, rather than on the day you need them.

The clock requirement, the twelve-month support limit, the battery, notification and network advice, the withdrawal dates for autofill and passwords and the causes specific to work accounts are quoted from Microsoft’s own support pages, read on 7 September 2026. The requirement that each side derive the current Unix time, and the thirty-second default, are quoted from RFC 6238. The order of the checks is ours.

Where to start

Four ways in.

“The code is refused every time.”: The clock, and why — the clock
“No prompt ever arrives.”: A different family — see prompts that never come
“My passwords have vanished.”: Not a fault — what was withdrawn
“It is my work account.”: Different causes — work accounts

The clock

The code is calculated on the phone from a shared secret and the time, in thirty-second steps. A wrong clock produces right-looking, wrong answers.

Two-factor and two-stepWhat the standard requires, and why the two names describe the same thing at different widths.Open this guide → Turning two-factor offWhere the option still exists, and the two clean-ups nobody mentions.Open this guide → Reporting phishing in OutlookFour clicks, and why reporting a sender does not block them.Open this guide →

Prompts that never come

Push notifications depend on the channel, on background permission and on the phone not silencing them. Three settings and one network swap.

Sharing a wifi passwordTwo routes, and the difference between giving access and giving the password.Open this guide → What a network security key isThe other secret a device asks for, and the protocol that decides its worth.Open this guide → Wifi that keeps disconnectingPower management, auto-switching, and the report your computer already keeps.Open this guide → A ChatGPT passwordA prompt that never comes, and the account setting that decides it was never coming.Open this guide →

What was withdrawn

Autofill stopped in July 2025 and stored passwords became inaccessible in August 2025. Half of «not working» is a decision with a date on it.

Forgotten Mac passwordThree reset routes, and the keychain that does not come back with the account.Open this guide → After a data breachWhat a leaked list is worth to whoever bought it, and the order to work in.Open this guide → Malware, in plain termsWhat the word covers, how it arrives, and the part that is not technical at all.Open this guide →

Work accounts

A block for unusual activity, a region where the text service is limited, a full inbox. Causes an organisation owns and a phone cannot fix.

Phishing, in plain termsThe shapes it takes, and the habit that works on the shape nobody has seen yet.Open this guide → Identity theftWhat can be done with the pieces already public, and how the first hour goes.Open this guide → Password-protecting a folderWhat device encryption covers, and where its recovery key lives.Open this guide → Changing a Facebook passwordWhere a second factor blocks the reset: the phone number that cannot do both jobs.Open this guide →

Questions people also ask

Why is my Microsoft Authenticator app not giving me a code?

Most often the phone’s clock. Microsoft: the app “requires your mobile device clock to accurately report your local time”. Set date and time to automatic, restart, and check the time again. After that, the app version, battery optimisation and notifications.

Why does the code look right but get rejected?

Because the code is calculated, not sent. RFC 6238 requires each side to “know or be able to derive the current Unix time”, in steps whose default is thirty seconds. A phone a minute out produces a valid code for the wrong half-minute.

Where have my passwords gone in Authenticator?

They were withdrawn. Microsoft: “starting July 2025, the autofill feature in Authenticator will stop working, and from August 2025, passwords will no longer be accessible in Authenticator.” The codes were not affected.

Does an old version of the app stop working?

Yes, by rule: “Microsoft does not support any app versions more than 12 months old.” On a phone that has stopped taking updates this arrives as a sudden failure.

Should I reinstall the app to fix it?

Not while you are locked out. Removing the app removes the accounts registered in it. Use a backup code, a second registered method or the help desk first, and reinstall afterwards.

Not covered here. It will not cover Google Authenticator or the other apps, which share the mechanism and differ in every menu.

It will not help you recover an account with no second method registered. That is a conversation with the service, not a setting on a phone.

And it will not tell you to reinstall. That is the one move that turns a refused code into a lockout. What holds instead is simple: the fixes are quoted from Microsoft’s own pages with the date they were read, and the reason the clock matters is quoted from the specification the codes are built on.

Locked out of an account, in four places

The same evening, four different companies. Each one publishes a condition that decides whether you get back in, and none of them shows it on the screen where the attempt fails.

The same job, in the other places it comes up: How to reset Gmail password when recovery keeps refusing; How do I change my Facebook password, and what stops a reset; How do I change IG password, and what the reset email hides; How to factory reset iPhone without password or computer: 3 ways; Forgot macbook password, and what a reset quietly costs

Sources

Microsoft Support — Troubleshoot problems with Microsoft Authenticator: the clock requirement, the twelve-month version limit, battery optimisation, notification settings, the network swap, and the dates on which autofill and stored passwords were withdrawn — support.microsoft.com, read 7 September 2026.
Microsoft Support — Common problems with two-step verification for a work or school account: the block for unusual activity, and the delivery causes that sit outside your phone — support.microsoft.com, read 7 September 2026.
RFC Editor — RFC 6238, TOTP: Time-Based One-Time Password Algorithm: the requirement that each side derive the current Unix time, and the thirty-second default time step — www.rfc-editor.org, read 7 September 2026.

Written by Alberto Gulotta

Founder and editor of AI Tools Primer, writing from Palermo, Italy. Thirty-five years of taking computers apart, starting with a Commodore 64 — the long version is on the about page.

Something wrong on this page? Write to aitoolsprimer@gmail.com and it gets fixed.

Written on 7 September 2026 · last checked 10 September 2026.

Independence and limits

No affiliate links and no paid placements anywhere on this site. Nobody pays to appear here, and no company has seen this page before you did.

This is general information, not professional advice. Where a page touches money, health, safety or the law, it names its source and the date it was read — and your situation may still differ. See the privacy page and the cookie policy.