365 tenant authenticator loop

Question

I am currently locked out of my Microsoft 365 account and I need assistance.

I am the owner and the only administrator of my tenant.

I recently reset my phone, and my Microsoft Authenticator setup was lost. There is no trusted device associated with my account anymore.

Now, when I try to sign in, Microsoft Authenticator is the only verification method available. However, it requires approval from the Authenticator app itself, which creates a loop (Authenticator asking for verification through Authenticator), so I cannot receive or approve any verification request.

i tried to call support with the appropriate number for my country but impossible to talk with a humain.

most of the help page need to Connect to the account and i cannot do it

Answer 1

Hi @Jon M

Although you mentioned that you’ve already tried calling support, I’d recommend contacting them again by following the steps below to ensure your request is routed correctly to the Data Protection team directly for assistance as only they have tools and processes in place to verify identity and regain access to administrator accounts.      

You can find the appropriate customer service phone numbers at this link: Customer service phone numbers.

Please remember to provide them with your account details and explain the situation. Be ready to provide:     

• The company name used during subscription    
• Billing email address (even if it’s a personal Microsoft account)    
• Payment method details (last 4 digits of the card, billing address)    
• Any subscription ID or invoice numbers from billing email    

When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.

To make the process smoother, here’s an example of how to respond when speaking to the automated system (IVR):     

IVR: What kind of problem are you concerned about?     

You:  Authenticator.    

IVR: What kind of product do you use?     

You: Office 365 for business.     

IVR: education or company account?     

You: For companies     

IVR: Are you an administrator?     

You: Yes.     

IVR: Do you have the other administrator in your organization?     

You: No.     

IVR: Do you need a... Service request?     

You: Yes     

These prompts help direct your call to the right support team more quickly, especially when dealing with account lockouts and authentication issues. 

If you still cannot reach to agent, there is still a workaround, you might consider registering for a new tenant by signing up for a trial subscription via this link Compare All Microsoft 365 Plans. This would allow you to create a new tenant following the provided prompts.    

• Follow the guided setup to create a new Microsoft account and a new tenant.
• This tenant will be completely separate from your existing Microsoft 365 environment.

Once set up, you can access the admin console of the new tenant by logging into admin center and follow the steps in this article: Get support - Microsoft 365 admin and submit a support ticket requesting to speak with the Data Protection team on behalf of your previous tenant.    

Include the following details:

• The administrator email address for the locked tenant
• The domain name of the locked tenant
• Any error messages you are seeing
• A description of the authentication or sign‑in issues
• Confirmation that you are the administrator of the locked tenant

Before submitting the ticket, make sure the Support Assistant is turned Off as several customers have reported that when the Support Assistant is enabled, the Contact Support option may not appear.

As shown in the screenshot, simply switch Support Assistant > Off, then enter your issue description. Once disabled, the Contact Support button should appear, allowing you to submit the ticket normally.

Important note:

• This new trial tenant does not provide access to any data, users, or settings from your original locked tenant. It is only intended as a temporary way to contact Microsoft Support.
• Once the issue with your original tenant is resolved, be sure to cancel the trial subscription to avoid any unintended charges. You can do this from the Microsoft 365 Admin Center by going to Billing > Your products and canceling the trial there.

Please remember to cancel the trial subscription once your issue is resolved to avoid any unintended charges.

As forum moderators, we don’t have access to the detailed system needed to troubleshoot this effectively due to privacy and security constraints. To quickly resolve this and regain access, the most effective step is to contact Microsoft Support Team directly. Only they have the ability to help with your Authenticator issue.    

Hopefully it will help work with your issue and if you have any other questions or need further assistance, feel free to ask.   

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Because Microsoft Authenticator is your only MFA method and you are the only administrator, this is a tenant lockout scenario that cannot be fixed self-service. Recovery must go through Microsoft support (Data Protection / Tenant Recovery).

Use these steps, in order:

1. Try again to reach Microsoft support by phone
   Use the official customer service phone for your country from Customer service phone numbers - Microsoft Support (in the context below). When the IVR (automated system) asks questions, follow a pattern like:
   • Problem: say “Authenticator”.
   • Product: “Office 365 for business”.
   • Account type: “For companies”.
   • “Are you an administrator?” → “Yes.”
   • “Any other administrators?” → “No.”
   • Ask explicitly to create a service request and escalate to the Data Protection team for a tenant admin MFA reset because the only global admin is locked out.
   The Data Protection team will then verify identity (business details, domain, contact info, etc.) and, once satisfied, reset MFA or add another authentication method so you can sign in again.
2. If phone support cannot be reached, create a temporary trial tenant to open a ticket
   If the phone system never connects to a human, use the documented workaround:
   • Sign up for a new Microsoft 365 trial tenant (separate from the locked one) using the public Microsoft 365 plans page mentioned in the context.
   • After the trial tenant is created, go to the Microsoft 365 admin center of this new tenant.
   • Open Support → Help & support and create a ticket. In the ticket:
     • State clearly that this new tenant is only to contact support.
     • Provide the admin UPN and domain name of the original locked tenant.
     • Explain that you are the only global admin, that MFA is enforced, and that Microsoft Authenticator is the only method and is no longer accessible due to a phone reset.
     • Request escalation to the Data Protection / Tenant Recovery team to reset MFA for the global admin on the original tenant.
   Be prepared to provide verification information (company details, billing info, domain ownership evidence, etc.). After verification, the Data Protection team can reset MFA or add another method so you can log back into the original tenant.
3. If there were another global admin (for others reading)
   A second global admin could sign into the Azure portal → Microsoft Entra ID → Users → select the locked account → Authentication methods → Require re-register multifactor authentication. On next sign-in, the locked admin would be prompted to set up MFA again. In your case, this is not available because you are the only admin.

Until Microsoft support (via Data Protection) intervenes, there is no supported way to bypass or self-reset the only MFA method for a sole global admin.

---

References:

• Common problems with two-step verification for a work or school account
• How to add your accounts to Microsoft Authenticator
• How Do I Regain Access to My Account After Losing Access to Microsoft Authenticator? (Urgent Request). - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• Global Admin Locked out - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• I can't sign in to my Microsoft account