Admin locked out due to MFA requirement

Question

Admin locked out because MFA required but authenticator was never configured
Reset MFA for admin account ******@spconsultation.ca

I am the administrator of the Microsoft 365 tenant for the domain spconsultation.ca. When attempting to sign in with the account ******@spconsultation.ca, I am required to enter a code from the Microsoft Authenticator app. However, the Authenticator app was never configured for this account, so I cannot generate the required code. As a result, I am locked out and unable to access the security settings to configure MFA.

I still have access to Outlook with this account on my computer, but any attempt to access security settings or the admin portal requires the MFA code.

Could you please reset or disable the MFA requirement for this admin account so that I can sign in and properly configure the authentication methods?

Tenant domain: spconsultation.ca

Admin account: ******@spconsultation.ca

Answer 1

MFA for the admin account cannot be reset or disabled directly here. The recovery path depends on whether there is another Global Administrator in the tenant.

1. If there is another Global Administrator
   • That admin must sign in to the Azure portal and go to Microsoft Entra ID → Users.
   • Select the locked-out admin account.
   • Open Authentication methods and select Require re-register multifactor authentication.
   • Next time the locked-out admin signs in, the portal will prompt to set up MFA again and allow configuration of Microsoft Authenticator or another method.
2. If this is the only Global Administrator
   • This is a tenant lockout scenario. MFA reset must be handled by Microsoft’s Data Protection/Tenant Recovery team.
   • Call Microsoft using the Customer service phone numbers - Microsoft Support channel and clearly state:
     • The issue is loss of access due to MFA on a Microsoft 365 for business / company account.
     • The caller is the only Global Administrator for the tenant.
     • MFA was never successfully configured and now blocks sign-in.
   • Ask the agent to open a Data Protection / Tenant Recovery ticket to verify identity and reset the admin’s authentication methods.
   • Be prepared to provide tenant and identity verification information as requested.
3. If support is hard to reach
   • As an alternative, create a new temporary Microsoft 365 tenant using a trial subscription.
   • From that new tenant’s Microsoft 365 admin center, open a support ticket and request to speak with the Data Protection team on behalf of the locked tenant, providing:
     • The locked tenant’s domain (spconsultation.ca).
     • The locked admin UPN.
     • Error messages and a description that MFA was never configured but is now required.

Forum moderators and tools outside Microsoft support cannot reset or disable MFA on the account. Only another Global Administrator or Microsoft’s Data Protection team can perform the necessary reset.

---

References:

• Common problems with two-step verification for a work or school account
• Use a screen reader to set up and troubleshoot multifactor authentication
• About administrator roles in the Microsoft 365 admin center
• Global Admin Locked out - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A