Locked out Error 399287

Question

Hello Microsoft team,

I am currently completely locked out due to an MFA failure.

Password authentication succeeds, but the sign‑in fails at the MFA step with Error Code 399287. The configured phone/SMS MFA method appears to be blocked, and there are no alternative MFA methods available on the account. As there is no second Admin, this has resulted in a full tenant lockout.

Please assist

---

Moved from: Microsoft Security | Microsoft Authenticator

Answer 1

Hello @Jessica Stubbs, 

I’m sorry to hear that the MFA issue resulted in a full tenant lockout.

In this case, you will need to contact the Microsoft Data Protection team, as they are the only group authorized and equipped with the necessary tools and verification procedures to confirm your identity and restore administrator access. 

Please try to find the related hotline number to call the frontline and let them raise a ticket for you: Customer service phone numbers - Microsoft Support 

Please carefully follow this instruction to ask for Microsoft Data Protection team support:   

Depending on your country or region. For some countries, when calling the support number, although there are about 30 seconds opening as something "you can visit the link...." But you can ignore this opening and wait until the option, then "1" as a business email user, "1" again for technical help.   

For some countries, it will be an automated conversation like:    

First, when you call the hotline, it asks what kind of problem you are worried about.   

Answered: authenticator.   

A: What kind of product are you using?   

B: Office 365 for business.   

A confirmation: education or company account?   

B: For companies   

A: Are you an administrator?   

B: Yes.   

A: Do you have the other admin in your organization?   

B: No.   

A: You need one.... Service request?   

B: Yes   

If your organization's Office 365 Business/Education subscription is from a partner or reseller, and the global administrator is unable to open a service request on your end, contact the reseller's support provider to help open a service request on behalf of you instead.   

Please understand that forum moderators have no control over user accounts, especially when it comes to logging in to your account, resetting your password, changing your access, etc.   

I hope you can successfully revoke your access. If you encounter any difficulties in contacting the frontline support, please feel free to let me know. Thank you and I wish you a great day!  

---

If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Error 399287 indicates that the phone number used for SMS verification has been flagged with a “bad reputation” and is being blocked for MFA, and because there are no alternative MFA methods and no second admin, this has resulted in a tenant lockout.

In this situation, the only supported resolution path is to have Microsoft Support/Data Protection reset the MFA configuration for the locked-out admin/tenant:

1. Open a support request with Microsoft using the affected tenant.
2. The case will be escalated to the Microsoft Data Protection (or equivalent identity) team.
3. That team can:
   • Reset the MFA settings for the affected account so that MFA methods can be re-registered, or
   • Clear the “bad reputation”/block on the phone number used for SMS verification.
4. After the reset, sign in again, complete MFA registration with a working method (preferably more than one method, such as Microsoft Authenticator plus phone), and verify access to the tenant.

For similar cases, Microsoft Support has resolved:

• Phone numbers blocked for SMS verification due to “bad reputation” by having the Data team reset MFA.
• Full tenant lockouts (single global admin, lost/blocked MFA) by engaging the Data Protection team through a support ticket to restore access.

Until Microsoft Support completes this process, self-service recovery is not possible because there is no second admin and no alternative MFA method configured.

---

References:

• Common problems with two-step verification for a work or school account
• Can't use Azure Multi-Factor Authentication to sign in to cloud services after you lose your phone or the phone number changes
• Troubleshoot sign-in problems with Conditional Access
• Use a screen reader to set up and troubleshoot multifactor authentication
• Planning for mandatory multifactor authentication for Azure and other admin portals
• 399287 - Microsoft Q&A Unable to Verify Identity for Azure Login – Error 399287
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• Azure has blocked myphone number for SMS verification due to a “bad reputation” flag - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A