Admin account is locked due to MFA issue

Question

Admin account is locked due to MFA issue.

Google Authenticator codes are not accepted.

We cannot access Microsoft 365 Admin Center.

Tenant: [Moderator note: personal info removed] 

Admin: [Moderator note: personal info removed] 

Requesting MFA reset.

---

Moved from: Microsoft Security | Microsoft Authenticator

Answer 1

I am having a similar issue accessing our backup account/tenant. No one has the authenticator on their app, so cannot get past MFA.

Answer 2

Hi @Kalyoj, 

Thank you for posting your question in the Microsoft Q&A forum. To protect your privacy and ensure the security of your personal information, I’ve removed any sensitive details from your public post and sent you a private message. You can check your private messages by clicking the banner at the top of the page, as shown in the image below. 

If there is another administrator in your organization, please check whether they can reset MFA for your account. However, if you are the only admin and you’re unable to authenticate at all, the next step is to contact Microsoft Support directly by phone. You can find the correct regional number here: Customer service phone numbers - Microsoft Support 

In this situation, the Microsoft Data Protection team has tools and processes in place to verify identity and regain access to administrator accounts. 

Please note that forum moderators have no control over user accounts, especially when it comes to logging in to your account, resetting your password, changing your access, etc  

Here are some tips and an example of a prompt to help you navigate the IVR more effectively:  

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)    

In some regions, the initial interaction may be automated, so here’s a general idea of how the conversation might go to help you prepare:      

What kind of problem are you experiencing?         

Answer: Authenticator         

What products do you use?         

Answer: Office 365 for business         

Is this for an education or company account?         

Answer: For companies         

Are you an administrator?         

Answer: Yes         

Are there any other administrators in your organization?         

Answer: No. I am the only admin in my tenant          

Do you need a... Service request?          

Answer: Yes. I need to create a ticket. Please send me direct to the Data Protection Teams.      

During the phone call, you will need to provide the information associated with your subscription, such as your company name, billing details, phone number, and an alternate email address, etc. This information allows the Data Protection team to verify your identity and securely assist you in regaining access to your administrator account.      

I hope these steps help you create a support ticket successfully and move closer to regaining access to your administrator account. While I’m not able to intervene directly, guiding you to the right support team is the most effective help I can provide here. 

If you have any updates or additional questions, feel free to reply to this thread. I’ll be glad to assist further wherever I can. 

Thank you very much for your understanding. 

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.  

Answer 3

MFA reset for an admin account cannot be performed from here. The resolution depends on whether there is another administrator in the tenant.

1. If there is another global admin or privileged authentication admin in the tenant
   • That admin must sign in to the Microsoft Entra admin center (or Azure portal) with their own account.
   • Go to Microsoft Entra ID → Users → All users.
   • Select the locked admin account.
   • Open Authentication methods.
   • Select Require re-register multifactor authentication.
   • The locked admin then signs in again and will be prompted to set up MFA from scratch (e.g., Microsoft Authenticator, phone, etc.).
   This is the standard way to reset MFA for a user who has lost access to their authenticator app or whose codes are not accepted.
2. If the locked account is the only global admin in the tenant
   • MFA reset must be handled by Microsoft’s Data Protection/Tenant Recovery process.
   • Call the regional Customer service phone numbers - Microsoft Support and state clearly:
     • This is an Office 365/Microsoft 365 for business tenant.
     • The caller is the only global admin and is locked out due to MFA.
     • MFA codes from Google/Microsoft Authenticator are not accepted and there is no alternative method.
     • A Data Protection / Tenant Recovery case is needed to reset MFA for the admin.
   • Follow the IVR guidance similar to:
     • Problem: “Authenticator”
     • Product: “Office 365 for business”
     • Account type: “Company account”
     • Role: “Administrator”
     • Other admins in organization: “No”
     • Need: “Service request” and ask to be routed to the Data Protection team.
   As an alternative path if support cannot be reached directly, a temporary trial tenant can be created and used only to open a support ticket to the Data Protection team on behalf of the locked tenant, providing the locked tenant name and admin UPN and explaining the MFA lockout.
3. If the issue is with text/voice MFA instead of app codes
   • Verify whether other verification options are available at sign-in (for example, Other verification options) and try a different method.
   • Another global admin should verify that the phone numbers and methods configured for the admin account are correct and that the account is not blocked from sign-in.

All MFA resets for an admin account must be performed either by another admin in the tenant or by Microsoft Support (Data Protection) after verifying tenant ownership. No one outside Microsoft or the tenant’s own admins can reset MFA for the admin account.

---

References:

• Can't use Azure Multi-Factor Authentication to sign in to cloud services after you lose your phone or the phone number changes
• You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
• About administrator roles in the Microsoft 365 admin center
• Common problems with two-step verification for a work or school account
• "Account verification system is having trouble" error message when you try to sign in by using a work or school account
• "Activation failed" error when you try to set up Azure Multi-Factor Authentication
• Planning for mandatory multifactor authentication for Azure and other admin portals
• Global Admin Locked out - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A
• Microsoft Curate - Troubleshoot Multi-Factor Authentication (MFA)