- Click on Users -> All Users'
- Search for User you intend to re-arm
- Click the user and click on Authentication Methods
- Click Once you find the Enrolled device you wish to remove. Click the ... to the very right of the line and click delete.
- Click the Revoke Multifactor Authentication Sessions button
- then Click the Require Re-Registration of Multifactor Authentication
This will trigger the user next time they open Office or any Microsoft product to be prompted to sign in, once they do they will be required to enroll their phone with the Microsoft Authenticator app.