Locked out of Microsoft 365 tenant – no Global Admin due to MFA (Data Protection case open)

Question

Hello @Liora D

Per your suggestion, I’m creating a new thread so we can move to private messaging.

I’m currently locked out of a Microsoft 365 Business Standard production tenant because MFA is enabled on the only Global Administrator account, and there are no remaining Global Admins in the tenant.

A support case is already open with the Microsoft 365 Data Protection team, and all requested ownership verification steps (including DNS verification) were completed promptly. However, access has not yet been restored, and the tenant has been inaccessible for nearly a week.

I’ve also contacted Microsoft Support by phone multiple times regarding this case. Each time, I was advised that the assigned Data Protection support engineer and the Duty Manager had been notified and that I should expect a same-day callback. Unfortunately, I have not received any follow-up, and this has been ongoing for several days.

With the holiday period approaching, I’m concerned the case may be stalled in a backend approval queue. I’d greatly appreciate your help checking the status and advising on escalation options or temporary Global Admin restoration.

Thank you very much for your time and assistance.

Answer 1

If you are locked out of your Microsoft 365 tenant due to Multi-Factor Authentication (MFA) issues and there are no remaining Global Administrators, you have a couple of options to consider:

1. Contact Microsoft Support: Since you already have a case open with the Microsoft 365 Data Protection team, continue to follow up with them. You can also escalate the issue by asking to speak with a supervisor or a higher-level support representative if you are not receiving timely updates.
2. Self-Service Password Reset (SSPR): If your organization has enabled the Self-Service Password Reset feature, you might be able to use it to regain access. This feature allows users to reset their passwords using their security information.
3. Emergency Access Accounts: If you have set up emergency access accounts (break-glass accounts) that are excluded from Conditional Access policies, you can use them to regain access to the tenant.
4. Promote a User to Global Administrator: If there are other users in the tenant, you might need to find another Global Administrator who can assist in promoting a user to the Global Administrator role.
5. Contacting Another Global Admin: If there are any other Global Admins in your organization, they can help you regain access by resetting the MFA settings or the password.

Since you mentioned that the case has been ongoing for several days, it may be beneficial to document all your communications with Microsoft Support and request an escalation due to the urgency of the situation, especially with the holiday period approaching.

---

References:

• Solve account access problems
• Preventing tenant lockouts

Answer 2

Dear Amjad P,

Welcome to Microsoft Q&A. 

Thank you so much for providing such a detailed description of your situation. Based on what you've shared, I understand that restoring access to your account while production services are affected is extremely important.

From my experience, the Data Protection team often handles a very high volume of cases, which can sometimes lead to delays. However, please rest assured that even during holiday periods, they continue working to ensure tenant security and account recovery processes are completed. So, if your case is already in their queue, it is being handled, and you can feel confident that progress will be made.

To move this forward securely, I’ll send you a private message, please check your notifications or refresh this thread, you should see the message appear at the top of the post.

Thank you again for your patience and for following the correct process so far. I’ll do everything I can to assist you. Wishing you a smooth resolution and a Merry Christmas and Happy Holidays!

Warm regards, 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".    

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.   

Answer 3

@Liora D and @Anonymous

I’m seeking clarification regarding the current status of this Global Admin MFA recovery case, as the updates I’m receiving are inconsistent.

I’ve been informed that the case is in an approval stage following ownership verification, but I was also told by data protection engineer a few minutes ago that the process cannot proceed because backend approval is still pending. This is the same status communicated over a week ago.

Has ownership verification actually been completed, or has there been no material progress during this time?

The tenant has now been fully locked out for more than 11 days, with no accessible Global Admin account. As a result, Microsoft remains the sole party with access to business-critical email and administrative control, and a production outage is ongoing.

If this is being handled as a high-impact (Sev A) incident, I would appreciate a clear and consistent status update on the following:

• Has ownership verification completed (yes/no)?
• Is backend approval the only remaining blocker (yes/no)?
• What has changed since this same status was communicated over a week ago?

At present, repeated references to “waiting for backend approval” without visible progress or a clear explanation make it difficult to understand whether this case is actively moving forward.

A concrete and unified status update would be appreciated.