Tenant locked due to incomplete MFA setup (AADSTS5000228) – Global Admin inaccessible

Question

My Microsoft 365 Business tenant is locked.

Security Defaults enforced MFA during initial setup.

MFA registration was interrupted.

Now the Global Admin account is inaccessible.

Error: AADSTS5000228 – Access to tenant is denied.

I cannot sign in to Entra ID or Admin Center.

This is a brand new tenant and no payment has been made.

I cannot open a support case because admin access is required.

Requesting manual MFA reset and temporary disabling of Security Defaults.

As suggested to me before here I contacted Microsoft Turkey Office by phone.

They confirmed that Microsoft Turkey no longer provides technical support for Microsoft 365 tenants.

They stated that only sales and marketing operations are handled locally.

I was explicitly instructed to contact Global Microsoft Support for tenant recovery.

so i stuck in a circle that going nowhere and cant do anything.

Answer 1

Hi @nedim tekbas,

Thank you for posting your question in the Microsoft Q&A forum, and I’m sorry to hear you're having trouble accessing your Global Admin account. I understand how concerning and it can be to lose access to your Microsoft 365 tenant, especially during the initial setup process.

Because administrator accounts have elevated permissions, Microsoft Entra ID requires them to use multi‑factor authentication (MFA) to maintain a higher level of security. In new tenants, MFA for administrators is enforced automatically through Security Defaults. This protection is enabled by Microsoft by design to reduce the risk of account compromise and is now a standard requirement for administrative access.

If MFA registration is interrupted during initial tenant setup, the administrator account can become temporarily inaccessible. This may result in errors such as AADSTS5000228 – “Access to tenant is denied”, preventing sign‑in to the Microsoft Entra admin center and Microsoft 365 admin center. In this state, self‑service recovery options are not available.

With that in mind, please follow the steps below to complete the account recovery process and regain access.

 

---

1/ Contact other IT admins

Please check to see if there are other IT admins in your company who can help you with the reset MFA for your account and share with them the steps outlined in the article Manage user authentication methods for Microsoft Entra multifactor authentication. This will help them assist you in resetting your MFA settings and restoring access to your account.

 

---

2/ Contact Microsoft Data Protection Support by phone

If you're the only admin, in this situation, the Microsoft Data Protection Team has tools and processes in place to verify identity and regain access to administrator accounts. You can try reaching out to our Global Customer Service phone to raise a request for resetting your authentication method here: Customer service phone numbers - Microsoft Support.

 

Please note that forum moderators do not have access to user account settings and cannot assist with logging in, resetting passwords, or changing access rights. While we do not have access to internal systems or administrative tools required to resolve account-specific or backend-related issues, we’ll continue doing our best to support you within the scope of our responsibilities.   

Here are some tips and an example of a prompt to help you navigate the IVR more effectively:     

IVR: What kind of problem are you concerned about?   

You: Authenticator.   

A: What products do you use?

B: Office 365 for business.

Verification: Education or company account?

B: For companies

A: Are you an administrator?

B: Yes.

A: Are there any other administrators in your organization?

B: No.

IVR: Do you need a... Service request?

You: Yes. I need to create a ticket. Please send me directly to the Data Protection Team.

---

3/ Create a new tenant to submit a support ticket

If you cannot reach a live agent, there is still a workaround, you might consider registering for a new tenant by signing up for a trial subscription.

To set up a new tenant, please follow these steps:

Visit Microsoft 365 Business Plans and Pricing | Microsoft 365. This would allow you to create a new tenant following the prompts provided. Once set up, you can access the admin console of the new tenant and submit a support ticket requesting to speak with the Data Protection team on behalf of your previous tenant.

Follow the guided setup process to create a new account for a new tenant.

Once your tenant is created, you should be able to access the support portal and submit your ticket referencing your locked account without further issues.

In your ticket description, you'll need to clearly explain that you're trying to regain access to your previous Microsoft 365 tenant and need help from the Data Protection team. Here's a message you can use or adapt:

"Hello, I’m currently unable to access my previous Microsoft 365 tenant due to losing MFA access, which prevents me from receiving verification codes. I’m the global admin, but I’m locked out and unable to generate a QR code or bypass MFA.

I created this new tenant solely to request assistance. I kindly ask to be connected with the Data Protection team to verify my identity and help me recover access to the original tenant.

This is urgent, as I rely on Microsoft 365 for my work and have been unable to operate for several days. I’m available to provide any documentation or verification needed to support the recovery process."

Ticket Support: In the Microsoft 365 Admin Center > Support > Help & Support.

Please remember to cancel the trial subscription once your issue is resolved to avoid any unintended charges.

I hope this helps you regain access to your account quickly. I'm glad to assist and truly hope the information provided has been useful. Please feel free to reach out anytime if you need further assistance.

If you find my post helpful, kindly consider marking it as the accepted answer. Doing so can assist others in the community who may have similar questions in finding solutions more quickly.

Thank you for your kindness and contributions to the forum.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

If your Microsoft 365 Business tenant is locked due to incomplete MFA setup and you are unable to access your Global Admin account, there are specific steps you can take to resolve this issue:

1. Contact Microsoft Support: Since you mentioned that local support in Turkey is limited, you should reach out to Global Microsoft Support directly. You can do this by calling the appropriate support number for your region, which can be found on the Microsoft support website.
2. Provide Necessary Information: When contacting support, be prepared to provide details about your tenant, including the error message (AADSTS5000228) and the circumstances surrounding the MFA setup. This information will help them assist you more effectively.
3. Emergency Access: If you have any other Global Admin accounts set up, you might be able to use them to reset the MFA settings or disable Security Defaults temporarily. If not, the support team should be able to assist you in regaining access.
4. Self-Service Password Reset (SSPR): If you have previously set up SSPR and it is enabled by your organization, you can try using it to reset your password and regain access to your account.
5. Prevent Future Lockouts: Once you regain access, consider setting up a break-glass account or emergency access account to avoid similar issues in the future. This account should be excluded from Conditional Access policies to ensure you can always access your tenant in emergencies.

If you are unable to resolve the issue through these steps, it is crucial to keep following up with Microsoft Support until you receive the necessary assistance.

---

References:

• Troubleshoot sign-in issues and account access problems
• Preventing tenant lockouts