365 Admin Business account goes into an MFA loop

Question

MICROSOFT 365 SUPPORT TICKET — ISSUE DESCRIPTION

Account Affected: <Mod remove PII> @[Moderator note: personal info removed]

Microsoft 365 Plan: Business Basic

Issue Summary: The account <Mod remove PII> @[Moderator note: personal info removed] is completely locked out due to a Multi-Factor Authentication (MFA) loop. The account cannot be accessed at all.

Error Code: 500121

What is Happening: When attempting to sign in to <Mod remove PII> @[Moderator note: personal info removed], the login process enters an MFA verification loop and fails to authenticate. The error code returned is 500121. The user is unable to complete the MFA challenge and is therefore fully locked out of the account. This affects access to Microsoft Teams, Outlook, the Microsoft 365 Admin Centre and all associated Microsoft 365 services.

What Has Been Attempted: Standard login has been attempted multiple times without success. The MFA prompt cannot be completed as the authentication loop fails at the verification stage. The user does not have alternative MFA methods configured that can be used to bypass the loop.

What We Need Microsoft To Do: We require the MFA settings on the account <Mod remove PII> @[Moderator note: personal info removed] to be fully reset by a Microsoft administrator. Once reset, we will reconfigure MFA correctly from scratch. Admin access is available via the Microsoft 365 tenant for [Moderator note: personal info removed]

Business Impact: This is a brand new Microsoft 365 Business Basic tenancy for a newly launched business - [Moderator note: personal info removed], trading as [Moderator note: personal info removed]. The affected account is one of only two accounts on the tenancy (<Mod remove PII> @[Moderator note: personal info removed] and <Mod remove PII> @[Moderator note: personal info removed]). The lockout is preventing the business from accessing critical communication and administration tools needed for day-to-day operations.

Tenant Domain: [Moderator note: personal info removed]

Additional Contact: please contact <Mod remove PII> @[Moderator note: personal info removed] or call <Mod remove PII> .

Answer 1

Hi @Client Chauffeur Network,

Thank you for reaching out to Microsoft Q&A forum. 

I understand you’re experiencing a complete lockout on your Microsoft 365 account due to an MFA verification loop, and you’re consistently seeing error code 500121 when trying to sign in. I know how disruptive this is, especially for a newly launched business that relies on Microsoft 365 for communication and day‑to‑day operations.

Since you are the sole Global Administrator for the tenant, please follow the steps below to complete the account recovery process and regain access. 

Option 1: Contact Microsoft Data Protection Support by Phone (Primary Method)   

I understand you have already attempted to contact Microsoft Support by phone and were unable to open a case through the IVR system. Please try the following option, and I sincerely hope it helps resolve the issue for you. 

To regain access to your admin account as you can't access the Admin Portal, you can try reaching out to our Global Customer Service phone to raise a request for resetting your authentication method here: Customer service phone numbers - Microsoft Support. During the call, request to speak to an agent, and share with them every detail related to your query and also mention that you are the only admin lost access to your account. This should allow you to contact the appropriate team so you can solve this incident as soon as possible.  

   

Here are some tips and an example of a prompt to help you navigate the IVR more effectively:        

In some countries, it is an automated conversation like:  

IVR: What kind of problem are you concerned about?        

You: Authenticator.        

IVR: What kind of product do you use?        

You: Office 365 for business.        

IVR confirmation: education or company account?        

You: For companies        

IVR: Are you an administrator?        

You: Yes.        

IVR: Do you have another administrator in your organization?        

You: No.        

IVR: Do you need a... Service request?      

You: Yes. I need to create a ticket. Please send me direct to the Data Protection Team.   

 

Option 2: Create a Temporary Account (Trial Tenant) to Submit a Support Ticket (Alternative Method)  

If you still cannot reach to a live agent, there is still a workaround, you might consider registering for a new tenant by signing up for a trial subscription via this link Microsoft 365 Business Plans and Pricing | Microsoft 365. This would allow you to create a new tenant following the prompts provided. Once set up, you can access the admin console of the new tenant and submit a support ticket requesting to speak with the Data Protection team on behalf of your previous tenant.        

 

Just to clarify, moderators do not have the ability to view or change user account information, so we cannot help with login issues, password resets, or modifying access rights. Even though we cannot access the internal tools required for account‑specific fixes, we are here to support you in every way we can within our scope. 

 

Please remember to cancel the trial subscription after your issue is resolved, as this will help you avoid any accidental billing. You may prefer the following resource for detailed instructions: Cancel your Microsoft business subscription in the Microsoft 365 admin center | Microsoft Learn  

    

I hope this helps you regain access to your account quickly. Please try the steps and let me know whether they resolve the issue. If the problem persists, we can work together to find a solution.  

As other users will also search for information in this community, your vote can significantly help those with similar inquiries quickly locate the most relevant resources. 

Thank you for your kindness and for contributing to the forum.   

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".       

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

Answer 2

The error and behavior described indicate an MFA/sign-in problem that must be fixed at tenant/admin or Microsoft support level, not by client-side changes.

Because admin access to the ccnetwork.uk tenant is available, the next steps are:

1. Use another global admin to reset the user’s MFA
   • Sign in to the Microsoft Entra/Microsoft 365 admin portal with a working global admin account on the same tenant (for example, the second account mentioned).
   • Follow the documented process to require the affected user to re‑register MFA methods. This clears the existing MFA configuration so it can be set up again from scratch. See: “Manage user authentication options” in the referenced documentation.
   • After this is done, have the affected user sign in again and complete MFA registration with fresh methods (Authenticator app, phone, etc.).
2. If there is no other working global admin, or the admin is also blocked
   • This becomes a tenant lockout scenario. In that case, Microsoft’s Data Protection team must intervene to reset access.
   • Open a support ticket from a different tenant or via phone:
     • If another tenant is available, create a support request from its Microsoft 365 Admin Center clearly stating that the administrator of the ccnetwork.uk tenant is locked out due to MFA and that MFA must be reset on the affected account.
     • If no other tenant is available, call Microsoft support using the country‑specific customer service phone numbers and state that this is an admin lockout/MFA issue for a business tenant. The frontline will route the case to the Data Protection team.
   • Be prepared to provide:
     • The locked tenant’s primary domain (ccnetwork.uk).
     • The affected admin UPNs.
     • Business verification information (company details, proof of domain ownership, etc.) so Data Protection can validate identity and ownership.
3. If the affected user is not a global admin
   • Any existing global admin on the tenant can reset that user’s MFA as in step 1 (Require re‑register MFA for that user), then the user signs in and reconfigures MFA.
4. If repeated sign‑in attempts continue to fail after MFA reset
   • Check for possible account lockout or security blocks in Microsoft Entra sign‑in logs (by a global admin).
   • If the account appears locked or sign‑ins are blocked due to risk or unusual activity, handle it through the admin portal or escalate via a support ticket.

In summary, resolving this 500121 MFA loop requires either:

• A working global admin on the tenant to force re‑registration of MFA for the affected account, or
• A Microsoft support/Data Protection case if all admins for the tenant are effectively locked out.

---

References:

• Common problems with two-step verification for a work or school account
• I need to reset my mfa methods - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A