Unable to Access Entra Admin Center Due to Forced MFA Without Setup

For a single global administrator who is locked out by MFA and cannot complete setup or use any alternative method, the only supported path is escalation to Microsoft support (Data Protection / Tenant Recovery). This must be handled by Microsoft; it cannot be fixed from the portal because there is no other admin who can reset MFA.

Use these steps:

1. Call Microsoft global customer support
   • Use the phone number for the region from Customer service phone numbers - Microsoft Support.
   • When navigating the IVR, clearly state that this is an issue with Authenticator and Office 365 for business, that it is a company account, and that this is the only global administrator and you are locked out due to MFA.
   • Ask explicitly to create a service request and be routed to the Data Protection team (sometimes called Tenant Recovery / account recovery for admins).
2. Explain the scenario to the agent
   • State that:
     • The tenant has only one global admin.
     • MFA is enforced, but MFA/Authenticator was never successfully configured.
     • No alternative verification methods (SMS/phone/app) are available.
     • You cannot access the Microsoft 365 or Entra admin portals to reset security info or open a ticket.
   • The Data Protection team will guide through identity and tenant ownership verification and then reset MFA registration or otherwise restore access.
3. If phone support is hard to reach
   • As an alternative path shown in similar cases, create a temporary trial tenant (for example, a Microsoft 365 trial) and use that new tenant’s admin center to open a support ticket.
   • In the ticket, clearly state that the request is for another existing tenant where you are the only global admin and are locked out by MFA, and request escalation to the Data Protection team for MFA reset / tenant admin recovery.

Once Data Protection completes verification, they can reset the MFA requirement or registration so that sign-in succeeds and MFA can then be configured properly (Authenticator and backup methods).

References:

• Frequently asked questions about Microsoft Entra multifactor authentication
• Can't use Azure Multi-Factor Authentication to sign in to cloud services after you lose your phone or the phone number changes
• You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
• Common problems with two-step verification for a work or school account
• Can't set up MFA because five devices are already registered to use an authenticator app
• Global Admin Locked out - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A