Loop on microsoft authenticator error code 500121 Business 365

Question

I am the admin for this account and just opened it, I did not set up my MFA in time and now I'm stuck in an authenticator loop and cannot verify or login to my account. I have called Microsoft support and made new claims for the past 3 days and have not had any call backs and need to get my account reset and back active so I can send/receive emails.

I need to get my MFA reset please...

Answer 1

Dear @sam stone,

I completely understand how frustrating it is, especially when you’re the administrator and can’t access your account or emails.

In cases where the affected account is the only Global Administrator, this becomes a tenant lockout scenario, and the MFA settings cannot be reset from the portal. The recovery must be handled by Microsoft’s Data Protection team.

At this point, the only supported resolution is to work with Microsoft Support so they can verify ownership of your tenant and reset the MFA configuration for your admin account.

If you have already contacted Microsoft Support and created a support case, may I kindly ask you to share the ticket number via private message? I can help check whether your case has been routed to the correct team (Data Protection) and advise if any escalation is needed.

If you have not been able to get through to support yet, there are 2 options I recommend you look through and try again:

Option 1: Contact Microsoft Data Protection Support by Phone  

Since you are the only administrator and are locked out, the most direct method is to call Microsoft's support line to raise a request for resetting your authentication method. For a full list of regional numbers, you can also visit this official page: Customer service phone numbers - Microsoft Support. The support team will assist you as soon as possible. For reference:  Get support | Microsoft Docs   

Here are some tips and an example of a prompt to help you navigate the IVR more effectively: 

In some countries, it is an automated conversation like: First, when you call the hotline, it will be asked as follows: 

IVR: What kind of problem are you concerned about? 

You: Authenticator. 

IVR: What kind of product do you use? 

You: Office 365 for business. 

IVR confirmation: education or company account? 

You: For companies 

IVR: Are you an administrator? 

You: Yes. 

IVR: Do you have the other administrator in your organization? 

You: No. 

IVR: Do you need a... Service request? 

You: Yes  

This process should connect you with a live agent who will create a service request with the Data Protection team. They will then contact you to help you regain access. 

Option 2: Create a Temporary Account (Trial Tenant) to Submit a Support Ticket 

If you have difficulty reaching an agent by phone, there is a reliable workaround. This involves creating a new, temporary Microsoft 365 account to contact the support team online. 

Step 1: Sign up for a new Microsoft 365 Business trial using this link: Compare All Microsoft 365 Plans. You will need to use a different, personal email address to register. 

Step 2: Once the trial account is created, log in to its Admin Center > From the Admin Center, open a new Service Request. For reference:  Get support | Microsoft Docs   

Step 3: In the ticket description, explain that you are locked out of your primary tenant (your.onmicrosoft.com) and that you need to speak with the Data Protection team to regain access.

Step 4: Remember to provide your locked account's details and a good contact number for them to reach you. 

Important: Please remember to cancel the trial subscription after your original account issue is resolved to avoid any future charges. 

I am confident that the Data Protection team can resolve this for you. Please try the phone option first, as it is the most direct path. Let me know if you have any questions about these steps. 

Note: Please understand that as a forum moderator, my role is to provide general guidance and troubleshooting support. I don’t have access to internal systems or backend tools, and I appreciate your understanding of these limits.

I hope the information shared helps point you in the right direction. Please try the steps above and let me know if they work. If not, we can continue working together to narrow this down.

The first response may not always resolve the issue right away, but with your help and more details, we can work toward a solution.

Thank you for your patience and understanding. I'm looking forward for your reply.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Error code 500121 and the “authenticator loop” occur because Microsoft Entra multifactor authentication is blocking or cannot complete verification, and there is no usable alternative method configured.

Because this is a Business 365 (work/school) tenant and the account is the admin, the only supported way to reset MFA in this situation is through another administrator or Microsoft’s Data Protection support channel.

Use these options:

1. If there is any other Global Admin on the tenant
   • Ask that admin to reset the MFA settings:
     • Sign in to the cloud service portal as admin.
     • Go to the Microsoft Entra / Azure AD MFA user management page.
     • Select the affected admin account.
     • Choose Manage user settings and select Require selected users to provide contact methods again, then save.
   • After this, sign in again; the account will be prompted to re-register MFA methods (Authenticator, phone, etc.).
2. If this is the only admin account on the tenant
   • Microsoft’s Data Protection team must reset MFA.
   • Call the regional Customer service phone numbers for Microsoft Support.
   • When navigating the IVR, clearly indicate:
     • The issue is with Authenticator / MFA.
     • The product is Office 365 for business / Microsoft 365 Business.
     • It is a company account.
     • The caller is the only administrator and is locked out.
     • A service request is needed and the call must reach the Data Protection team.
   • The Data Protection team has tools and processes to verify identity and regain access to the administrator account and reset MFA.
3. If support is hard to reach
   • As a workaround, create a temporary Microsoft 365 trial tenant.
   • From that new tenant’s Admin Center, open a support ticket and clearly state:
     • This is a different tenant.
     • The request is to recover admin access and reset MFA on the original tenant where the caller is the sole admin.
   • Ask support to route the case to the Data Protection team for MFA reset on the original tenant.

Once MFA is reset and access is restored, configure multiple verification methods (Authenticator plus phone/SMS or another method) to avoid being locked out again.

---

References:

• Can't use Azure Multi-Factor Authentication to sign in to cloud services after you lose your phone or the phone number changes
• "Account verification system is having trouble" error message when you try to sign in by using a work or school account
• Use a screen reader to set up and troubleshoot multifactor authentication
• Common problems with two-step verification for a work or school account
• How to add your accounts to Microsoft Authenticator
• I cant log in to my business account because it is requiring Authenticator app which I do not have - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A