Share via

Lost access to Microsoft Entra tenant but still own the domain and OAuth application

Lancelot Girard 0 Reputation points
2026-06-05T15:06:22.2533333+00:00

Hello,

We are trying to recover access to a Microsoft Entra tenant associated with our company domain.

Facts:

  • We still own and control the DNS zone for our domain.

Our production application uses Microsoft Login through an existing App Registration.

The Microsoft login flow is still working in production.

However, we no longer know who the tenant administrator is and no current employee has administrative access.

We need to update the Redirect URIs because we are migrating to a new application domain.

What we observe:

Our domain appears as "Managed" in Microsoft.

We can prove ownership of the domain through DNS records.

We cannot access Users, App Registrations, or Tenant settings.

We receive AADSTS50020 and authorization errors when trying to access Entra administration pages.

Questions:

  1. What is the recommended recovery process when a company still owns the domain but has lost all known Global Administrators?
  2. Can Microsoft restore administrative access after DNS ownership verification?
  3. What is the correct support channel for this situation if we cannot access the tenant administration portal?
Microsoft Security | Microsoft Entra | Microsoft Entra ID

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-06-05T15:06:49.3133333+00:00
    1. The recommended recovery process when all known Global Administrators are lost is to work with Microsoft support and the Data Protection team to re-establish administrative access. The general pattern is:
      1. Confirm that the tenant is indeed associated with the company by checking domains and unmanaged/managed directory status. If the domain is associated with an unmanaged directory, use the Administrator Takeover process to claim it as a Microsoft Entra administrator. For unmanaged directories, follow the Admin takeover of an unmanaged directory guidance referenced from the checklist for tenant setup and GDAP management and the partner-center guidance on Administrator Takeover.
      2. If the tenant is a normal managed tenant (as in this case) and there is a complete loss of Global Admin access, open a support ticket and have the case escalated to the Microsoft Data Protection team. They have tools and processes to verify identity and regain access to administrator accounts when there is only one or no accessible admin.
      3. Be prepared to provide proof of ownership such as official business documentation and domain ownership, as described in the tenant access recovery and cloud footprint guidance.
    2. Microsoft can restore administrative access, but only after completing identity and ownership verification through the standard support and Data Protection processes. DNS ownership alone is not sufficient by itself; it is one of several signals used. The Data Protection team can:
      • Reset credentials of an administrator account.
      • Help claim ownership of normal tenants when the organization is locked out.
      This is explicitly called out in the Discover your Microsoft cloud footprint FAQ and in the Q&A cases where the Data Protection team re-enabled access for tenants where the only admin was locked out (for example, due to MFA issues).
    3. If the tenant administration portal cannot be accessed, the correct support channels are:
      1. Open a Microsoft 365/Azure support ticket as the tenant administrator (if any access remains) or via another tenant or partner:
        • From the Discover your Microsoft cloud footprint FAQ: when locked out of a tenant, open a support ticket and the Data Protection team can help reset an admin account or help claim ownership.
        • From the nonprofit tenant access recovery guidance: use the Microsoft 365 support page and select the option for being unable to sign in or access the tenant.
      2. If no admin portal is accessible at all, use the global customer service phone numbers to reach Microsoft support and request a service ticket for tenant lockout and admin recovery. The Q&A examples show this as the path when the only admin is locked out (e.g., due to Authenticator/MFA issues or tenant inactivity).
      3. If the tenant was created via a Microsoft partner, contact the partner so they can open a support request on behalf of the organization.

    Once support is engaged, clearly state that:

    • The organization still owns the domain used by the tenant.
    • All known Global Administrators are unavailable or unknown.
    • There is a production app registration that must be updated.

    Support will then route the case to the Data Protection team to perform identity verification and, if successful, restore or create a Global Administrator so that redirect URIs and other app registration settings can be updated.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.