If a user gets a new phone or sees a prompt to choose an authentication method, this is the expected two-factor authentication (2FA) login process. The way to resolve this depends on whether you've enabled 2FA via the domain for all users, or the user enabled it themselves on their account.
Domain level
If you've enabled 2FA via the domain, if the domain owner logs into Access Identity via the Identity Access Cloud page, they can reset the user's 2FA. To do this, simply click Two-factor authentication then click Disable for someone else.
Whoever set this up can add account owners to allow other users to log in and manage this.
User level
If the user enabled 2FA on their own account, if the codes from their authenticator app aren't working, they can use the backup codes that generate on setup to gain access to their account.
If they expect to receive the code via email but it hasn't arrived in their inbox, we recommend they check their junk and spam folders, and that your IT department whitelists our IPs and domain.