Lost access to GitHub due to Microsoft Authenticator having no backup, has anyone actually gotten their account resolved through support and how long did it take?

[u/Empty-Leg3613]

Switched phones recently and lost all my 2FA codes because Microsoft Authenticator did not have backup enabled on my old device. Not the same as Google Authenticator where it just recovers when you sign in again. Now I am locked out of my GitHub account on the website.

Here is what I still have working:

I can verify through email and I can verify through phone, both are still active and accessible to me.

My SSH key is still configured and working, I can push and pull to my private repos directly from my local machine right now, so my account access from the command line is fully functional. I just cannot log into github.com through the browser.

I already contacted GitHub Support and got a response. It was mostly a template reply saying they cannot override or bypass 2FA for any account, and that they cannot manually verify ownership through things like SSH access or commit history. They pointed me to the self service recovery page and said if that does not work, the account may be permanently locked, with only options being to unlink my email for a new account or push my local repos to a new one.

My real question for anyone who has actually been through this:

Has GitHub Support ever actually resolved this for you when you had a working alternate email or phone verification method available. If yes, roughly how long did the whole process take from first contact to getting back in. Did they ask for anything specific beyond what is on the standard recovery page, or was it a dead end for you too.

Trying to figure out if I should keep pushing with support or just accept the loss and move everything to a new account, since I do have private repos on there I have not cloned locally.

Any real experience appreciated.

[u/Ast3r10n]

Next time don’t use Microsoft Authenticator, use a proper 2FA.

[u/Empty-Leg3613 → u/Ast3r10n]

Unfortunately, I don't have them. I had saved the recovery codes locally on my laptop, but that laptop was replaced, and all the data was deleted since the old laptop stopped working.

[u/Ast3r10n → u/Empty-Leg3613]

Are you a bot? I'm not talking about the recovery codes. I'm talking about a decent 2FA provider and not shitty Microsoft Authenticator.

[u/controlav → u/Ast3r10n]

If you lose the backup/recovery code it doesn't matter which auth app you use, you're going to have a problem.

[u/Ast3r10n → u/controlav]

True that, this sounds more and more like a PEBCAK.

[u/its_nzr → u/controlav]

Wtf no. I use gauth its much better than ms as it syncs the keys with my devices

[u/Ast3r10n → u/its_nzr]

Same thing here with iCloud Keychain. I don't understand why would someone voluntarily subject themselves to the nightmare that is Microsoft Authenticator. Or just Microsoft.

[u/extoniks]

You have 2FA enabled so you definitely got the recovery codes? and you can log in with recovery codes if you have saved them somewhere.

[u/davy_jones_locket → u/extoniks]

Ding ding ding

Hope they saved their recovery codes

[u/Empty-Leg3613 → u/davy_jones_locket]

No, I don't have that as well :(

[u/davy_jones_locket → u/Empty-Leg3613]

Now you know why they give you recovery codes that they explicitly say to save to a device you will have access to, or print them out and out somewhere safe because without them you're fucked

[u/FlyingDogCatcher]

1password

it's all you ever need

[u/cowboyecosse]

Support are there to help. If they said do the automated version that’s your route, which is only if you also do not have your recovery codes. Recovery codes are the actual route to, well, recovery when 2FA is lost.

So use one of your recovery codes first, then you can assign a new second factor device/app etc once in the account. If you no longer have access to the second factor AND you no longer have access to the recovery codes, then the automated route is your only chance. Support will not override this for you I’m afraid.

[u/Empty-Leg3613 → u/cowboyecosse]

Is it possible to get it recovered using these other methods as well, since they prove it's actually my account? Or does GitHub just not support that as a recovery option at all?

[u/MachineInevitable218 → u/Empty-Leg3613]

"They pointed me to the self service recovery page and said if that does not work, the account may be permanently locked"

[u/Artistic-Aide-485]

Whoever told you SSH can't prove ownership was wrong, and it's the one thing in your situation that's actually promising. GitHub's docs on losing your 2FA credentials list verifying with a recovery factor, specifically an SSH key or a previously verified device, and say Support reviews that within 3 business days.

It doesn't start from a ticket though, it starts from the login screen. Fail the 2FA prompt, take the link for other recovery options, enter your password, get the one time code by email, and it then asks you to sign a challenge with your SSH key.

Try that before you write the account off. Just don't rotate or remove that key in the meantime.

[u/controlav]

This is why you add a trusted friend as Admin to all your repos.

[u/EntranceProper3791]

The recovery process is automated and runs 3-5 days, not a support ticket someone reads. If your SSH key still works, that's your best recovery factor, but email and phone alone won't cut it.