Lost my authenticator.

Question

As noted in the title, I have lost access to my authenticator app. How can I recover my account? Please note that I am the only Global Administrator for this tenant.

Answer 1

Hello @Cheewei Yong,  

Welcome to Microsoft Q&A forum. 

May I ask if you have any alternative method to sign-in besides Authenticator? If yes, please try sign-in using this alternative method. 

If you don't have any alternative sign-in method, you'll need to revoke your MFA access, which will allow you to set up Authenticator on a new device and then you can access other Microsoft services.  

As you are the only administrator in your organization, you will need to contact the Microsoft Data Protection team, as they are the only group authorized and equipped with the necessary tools and verification procedures to confirm your identity and restore administrator access. 

Please try to find the related hotline number to call the frontline and let them raise a ticket for you: Customer service phone numbers - Microsoft Support 

Please carefully follow this instruction to ask for Microsoft Data Protection team support:   

Depending on your country or region. For some countries, when calling the support number, although there are about 30 seconds opening as something "you can visit the link...." But you can ignore this opening and wait until the option, then "1" as a business email user, "1" again for technical help.   

For some countries, it will be an automated conversation like:    

First, when you call the hotline, it asks what kind of problem you are worried about.   

Answered: authenticator.   

A: What kind of product are you using?   

B: Office 365 for business.   

A confirmation: education or company account?   

B: For companies   

A: Are you an administrator?   

B: Yes.   

A: Do you have the other admin in your organization?   

B: No.   

A: You need one.... Service request?   

B: Yes   

If your organization's Business/Education subscription is from a partner or reseller, and the global administrator is unable to open a service request on your end, contact the reseller's support provider to help open a service request on behalf of you instead.   

Please understand that forum moderators have no control over user accounts, especially when it comes to logging in to your account, resetting your password, changing your access, etc.   

I hope you can successfully revoke your access. If you encounter any difficulties in contacting the frontline support, please feel free to let me know. Thank you and I wish you a great day!  

---

If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Because the only registered method is Microsoft Authenticator and the only Global Administrator is locked out, this is a tenant lockout scenario that requires Microsoft support intervention.

Use these approaches depending on the account type and what can still be accessed:

1. If this is a personal Microsoft account (consumer)
   • If there are other sign-in methods configured (SMS, email, security key, etc.), use one of those to sign in instead. For passwordless accounts, any other configured method can still be used.
   • If the phone was lost or replaced, remove the old device’s authenticator method:
     1. Sign in to the Microsoft account dashboard and go to Security > Advanced security options.
     2. Under Ways to prove who you are, find the Send sign-in notification entry for the old device.
     3. Expand it and select Remove.
   • If access to the Authenticator backup (iCloud/backup account) is lost and no other methods work, use the Microsoft account sign-in helper to try to regain access to the backup account, then restore or re-add accounts:
     • Use the Sign-in helper for the backup Microsoft account.
     • If still unable to restore, re-add accounts to Authenticator following the guidance in How to add your accounts to Microsoft Authenticator.
2. If this is a work or school account and another Global Admin exists
   • Any other Global Administrator can reset the MFA registration so a new device can be enrolled:
     1. Sign in to the Azure portal as a Global Admin.
     2. Go to Microsoft Entra ID > Users.
     3. Select the locked-out user.
     4. Open Authentication methods and select Require re-register multifactor authentication.
     5. Next sign-in for that user will prompt to set up MFA again on the new Authenticator app.
3. If this is a work or school account and there is no other Global Admin (sole admin locked out)
   • This is a tenant access recovery / Data Protection case. Normal self-service flows and standard support agents cannot bypass MFA or reset admin credentials without identity verification.
   • Recovery must go through Microsoft support and Data Protection / Tenant Recovery:
     1. Call Microsoft Global Customer Service using the published phone numbers for the region.
     2. When prompted by the IVR, clearly indicate:
        • Product: Office 365 / Microsoft 365 for business.
        • Account type: company/education account.
        • Role: administrator.
        • Situation: only Global Administrator, locked out due to lost Authenticator, need Data Protection / Tenant Recovery to reset MFA.
     3. Ask explicitly for a service request and escalation to the Data Protection or Tenant Recovery team.
     4. Be prepared to provide business documentation and tenant ownership proof as requested (for example, domain ownership or official organization documents).
   • In similar cases, support has:
     • Opened a Data Protection ticket.
     • Verified identity and tenant ownership.
     • Reset MFA or re-registered at least one admin account and added an additional auth method.
4. If support routing is blocked because the admin portal cannot be accessed
   • If phone support cannot be reached or keeps misrouting, an alternative used in similar cases is:
     • Create a temporary new tenant using a Microsoft 365 trial subscription.
     • From that new tenant’s admin center, open a support ticket requesting contact with the Data Protection team on behalf of the original tenant that is locked out.
   • Data Protection then works with the original tenant to restore access.
5. After access is restored
   • Add multiple MFA methods (Authenticator, SMS, phone, security key) for the Global Admin account.
   • Ensure at least one additional Global Admin or break-glass account is configured with separate MFA methods to avoid future tenant lockouts.

---

References:

• Restore account credentials from Microsoft Authenticator
• How to go passwordless with your Microsoft account
• Common problems with two-step verification for a work or school account
• Tenant access recovery
• How Do I Regain Access to My Account After Losing Access to Microsoft Authenticator? (Urgent Request). - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A
• Global Admin Locked out - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A