Global admin locked out of developer tenant due to MFA

Question

I am the only Global Admin in this tenant and I can’t complete MFA, so I need Microsoft to reset my MFA registration so I can sign in.

Answer 1

Hi @Thabiso Ntoi

Thank you for posting your question in the Microsoft Q&A forum. 

According to your situation, since you are the only Global Administrator and you are completely locked out from the tenant. So, only Microsoft Support team can help you in this MFA issue. You might need to contact us via phone service number: Customer service phone numbers - Microsoft Support. The agent will be able to create a ticket for you under the affected tenant and then transfer this ticket to Data Protection team who could help you to regain access.  

To connect directly with a real person, the call must include the term AdminCenter, and the role must be specified as Global Administrator. In the description of the request, the term AdminCenter must also be mentioned. During the telephone dialog, if asked about another administrator, you can answer “no.” The call will then be forwarded to a real support agent, and a service request can be created.  

Please note that this team is always overwhelmed, so you might need to wait for them to call you, this should take 3-10 working days. I know that this is not a convenient solution to hear but it seems to be the only way, and it's recommended that you should have a secondary/backup Global Administrator to fix this issue on your own.    

In case the phone line is not supportive, you can consider directly submitting a support request as a helpful workaround:    

-Create a temporary Microsoft 365 tenant using a trial license: Go to Microsoft 365 Business Plans and Pricing and click Try for free to set up a temporary Microsoft 365 tenant with a trial license.

-Use this new account to sign in to the Microsoft 365 Admin Center and submit a support request on behalf of your primary (locked) account.   

-Click Help & Support > then choose Create a support request.    

Note: This method doesn't require you to use your new account for your business. Instead, it allows you to create a temporary global administrator account so you can submit a support request, as your original global administrator account is locked out due to issues with multi-factor authentication. The trial account is free for one month. Be sure to delete it after submitting your support request to avoid any automatic renewals or charges from Microsoft. 

For further instructions, you can follow this guide: Get support - Microsoft 365 admin | Microsoft Learn.   

I appreciate your understanding and patience in this matter. While I truly want to assist you, this issue is beyond the scope of my role as a forum moderator. I do not have access to internal databases or the ability to escalate cases directly to Microsoft’s internal teams. Therefore, please kindly contact the Microsoft Support team for the most efficient help. 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".       

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.  

Answer 2

Because this is a tenant lockout where the only Global Administrator cannot complete MFA and there is no other admin who can reset it, recovery must be handled by Microsoft’s Data Protection / Tenant Recovery team.

Follow these steps:

1. Contact Microsoft support by phone and ask specifically for the Microsoft 365 Data Protection (or Tenant Recovery) team so they can verify tenant ownership and reset MFA for the global admin:
   • Use the regional phone numbers listed at Find Microsoft 365 for business support phone numbers by country or region.
   • Clearly state that:
     • This is a Microsoft 365 business/developer tenant.
     • MFA is required for admin sign-in.
     • There is only one Global Administrator.
     • The Global Administrator knows the password but cannot complete MFA and has no alternative sign-in methods.
     • A reset of MFA registration for the Global Administrator is required.
2. If frontline support routes incorrectly (for example, to a non-commercial queue), insist that this is a tenant lockout for a Microsoft 365 business/developer tenant and request escalation to the Data Protection team or Tenant Recovery team.
3. If a partner with GDAP access exists and has appropriate roles (for example, Privileged Authentication Administrator or Global Administrator), that partner can instead:
   • Sign in to the Azure portal → Microsoft Entra ID → Users → select the locked-out admin → Authentication methods → Require re-register multifactor authentication.
   • After this, the admin signs in again and is prompted to set up MFA from scratch.

If there is no such partner and no other Global Administrator, only Microsoft support (Data Protection/Tenant Recovery) can reset MFA and restore access.

---

References:

• Preventing tenant lockouts
• Tenant Lockout: Scenarios & Next Steps
• Troubleshoot sign-in issues and account access problems
• You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
• Common problems with two-step verification for a work or school account
• Can't set up MFA because five devices are already registered to use an authenticator app
• Global Admin Locked out - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A