MFA Reset Required – Global Admin Locked Out (Microsoft Entra)

Question

Hello Microsoft Support Team,

I have an urgent access issue with my administrator account. I am the only Global Administrator of the tenant.

Recently, I lost my mobile device which had the Microsoft Authenticator app installed. As a result:

• I cannot approve MFA requests via Authenticator
• I am unable to receive SMS verification codes (the system fails to send them)
• I do not have any alternative authentication methods configured

Because of this, I am completely locked out of the admin account and cannot access the tenant at all.

Thank you.

Answer 1

This situation is a tenant lockout with a single Global Administrator who cannot complete MFA and has no alternative methods available. Self-service recovery is not possible; recovery must be handled by Microsoft Support/Data Protection.

Required next steps:

1. If there is any other Global Administrator in the tenant (even if not obvious), that admin must:
   • Sign in to the Azure portal → Microsoft Entra ID → Users → select the locked-out admin account → Authentication methods → select Require re-register multifactor authentication.
   • After this, the locked-out admin signs in again and is prompted to set up MFA from scratch (for example, Microsoft Authenticator, phone, or another method).
   This is the standard remediation when another global admin exists.
2. If there is truly no other Global Administrator (single-admin tenant lockout):
   • This is treated as a tenant lockout / severity situation.
   • Recovery must be escalated to the Microsoft Data Protection / Tenant Recovery team via a support request.
   • Because the locked-out admin cannot access the admin portal to open a ticket, the path is:
     • Call Microsoft global customer service for business support and request a ticket specifically for Data Protection / Tenant Recovery to reset MFA for the only Global Administrator on the tenant.
     • Clearly state during the call that:
       • This is a business/organization (not personal) account.
       • The caller is the only Global Administrator.
       • MFA is enforced and cannot be completed because the device with Microsoft Authenticator is lost and no alternative methods are configured.
   • In similar cases, moderators have confirmed that Microsoft Support/Data Protection will contact the admin (by phone or email) to verify tenant ownership and then reset MFA registration so that new methods can be configured.
3. If support phone routing is difficult:
   • As shown in similar resolved cases, one workaround is to create a temporary new Microsoft 365 tenant (for example, via a trial subscription), sign in as its admin, and use that admin center to open a support ticket requesting Data Protection assistance for the original locked-out tenant. The Data Protection team then works with the caller to restore access to the original tenant.
4. After access is restored:
   • Configure multiple MFA methods (for example, Microsoft Authenticator plus phone call/SMS) and consider more resilient methods such as passkeys (FIDO2) or certificate-based authentication where appropriate.
   • Implement at least two emergency access (“break glass”) accounts with Global Administrator role and excluded from normal MFA policies, as described in the emergency access account guidance, to prevent future tenant lockouts.

---

References:

• You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
• Can't use Azure Multi-Factor Authentication to sign in to cloud services after you lose your phone or the phone number changes
• Can't set up MFA because five devices are already registered to use an authenticator app
• Manage emergency access accounts in Microsoft Entra ID
• Preventing tenant lockouts
• Frequently asked questions about Microsoft Entra multifactor authentication
• Common problems with two-step verification for a work or school account
• Global Admin Locked out - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A