Only Global Admin locked out – MFA / Authenticator not receiving notifications

Question

I am the only Global Administrator for our Microsoft 365 / Entra ID tenant. I am unable to sign in because Microsoft Authenticator push notifications are not arriving. There are no other admins who can reset my authentication methods. I need Microsoft Data Protection Team assistance to reset/bypass MFA so I can regain admin access.

Answer 1

Hi @Marko Manenica,

Thank you for reaching out to the Microsoft Q&A forum.

Since you are the only Global Administrator and are completely locked out due to MFA, this situation cannot be resolved through the community. Direct Microsoft Support assistance is required.

Please proceed with one of the following options:

Option 1: Contact Microsoft Support by Phone (Recommended)

• Customer service numbers: https://support.microsoft.com/help/4051701
• When prompted, select:

  + Issue: Authenticator / MFA / Password reset

  + Product: Microsoft 365

  + Role: Admin

  + Clearly explain that:

• You are the only Global Administrator
• You are locked out
• Password reset is not working
• No other admin exists in the tenant
• Data Protection Team verification is required

Microsoft will need to verify tenant ownership before restoring access.

Option 2: Create a Temporary Trial Tenant (If Phone Support Is Unavailable)

• Start a Microsoft 365 free trial
• Sign in to the Admin Center of the trial tenant
• Go to Support → Help & Support
• Create a service request
• In the request, include:

  + Blocked admin email address

  + Affected domain name

  + Any error messages

  + Confirmation that you are the only administrator

Microsoft will complete formal ownership verification before making changes.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Because there is only one global admin on the tenant and multifactor authentication cannot be completed, this is a tenant lockout scenario that requires Microsoft support (Data Protection team) to restore access. There is no self-service way to bypass or reset MFA in this situation.

Follow these steps to proceed:

1. Contact Microsoft support by phone
   • Call the appropriate regional support number listed under Customer service phone numbers - Microsoft Support.
   • When connected to the IVR/agent, clearly state:
     • The issue is admin locked out due to MFA / Microsoft Authenticator not working.
     • This is a business / Microsoft 365 for business / company account.
     • There is no other global administrator on the tenant.
     • A Data Protection / Tenant Recovery / Microsoft 365 Data Protection team escalation is required to reset MFA for the only global admin.
2. Work with the Data Protection team
   • The frontline agent should create a support request and route it to the Data Protection team (sometimes referred to as Microsoft 365 Data Protection or Tenant Recovery).
   • Be prepared to provide tenant and ownership verification information (company details, domain, subscription info, etc.) as requested.
   • The Data Protection team will work with you to:
     • Verify ownership of the tenant.
     • Reset or clear the MFA requirement for the global admin account so that sign-in is possible again.
3. After access is restored
   • Sign in as global admin and reconfigure MFA methods with redundancy:
     • Register Microsoft Authenticator on the current device.
     • Add at least one backup method (phone call, SMS, or another app/device) via https://aka.ms/mysecurityinfo.
   • Consider adding at least one additional global admin so that MFA resets can be performed internally in the future.

If the support line in your region routes through automated prompts, answer along the lines of:

• Problem: “Authenticator” or “Can’t sign in – admin account.”
• Product: “Office 365 for business” / “Microsoft 365 for business.”
• Account type: “Company account.”
• Are you an administrator?: “Yes.”
• Do you have another administrator?: “No.”
• Request: “Yes, I need to create a ticket and speak with the Data Protection team to restore access to my tenant.”

Forum moderators and documentation cannot directly reset or bypass MFA; only Microsoft support (Data Protection team) can handle this tenant lockout scenario.

---

References:

• Troubleshoot sign-in issues and account access problems
• Preventing tenant lockouts
• Can't use Azure Multi-Factor Authentication to sign in to cloud services after you lose your phone or the phone number changes
• You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
• Common problems with two-step verification for a work or school account
• Troubleshoot problems with Microsoft Authenticator
• Global Admin Locked out - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A
• Frequently asked questions about Microsoft Entra multifactor authentication
• Can't set up MFA because five devices are already registered to use an authenticator app