I'm putting this small tuto here, I've been stuck with my syno two times because of the mfa not working (key change after a DSM migration and another time when I had a pb with the clock not on time which was blocking the 2fa key calculation) :

With a ssh admin user, ssh to your NAS and go in the directory

/usr/syno/etc/preference/@DH-DOMAIN/0/

Find the directory of the user you want to modify and chdir into it, then remove the file google_authenticator

note : it's good to have a spare local admin user even if you are in a domain/ldap

source ici