My global admin account cant authenticate via mfa, how i resolve this?

Question

I bought new phone and wiped old phone before i signin with my global admin account on microsoft authenticator app on new phone, so it is unable to a authenticate with mfa, how can i resolve this, i dont secondary global admin, i didnt setup other mfa mechanisim like sms or call. so i am stuck on our developer account.

Answer 1

Hi @Pitsi Ngoetjana,

Thank you for posting your question, and I’m sorry to hear you're having trouble accessing your Admin account.

Changing to a new phone often triggers this issue because your Multi-Factor Authentication (MFA) settings usually need to be reset. When you switch devices or reinstall the Microsoft Authenticator app, your new phone isn’t automatically configured for authentication. Since the app is still tied to your previous device, you’re unable to receive authentication codes on the new one, which is why you can’t access your account right now.

Since you are the sole Global Administrator for the tenant, please follow the options below to complete the account recovery process and regain access.

---

Option 1: Contact Microsoft Data Protection Support by phone (Please proceed with the second option if contacting phone support is not applicable to the situation)

To regain access to your admin account as you can't access the Admin Portal, you can try reaching out to the Global Customer Service phone to raise a request for resetting your authentication method here: Customer service phone numbers - Microsoft Support. During the call, request to speak to an agent, and share with them every detail related to your query and also mention that you are the only admin lost access to your account. This should allow you to contact the appropriate team so you can solve this incident as soon as possible.

Please note that forum moderators do not have access to user account settings and cannot assist with logging in, resetting passwords, or changing access rights. While we do not have access to internal systems or administrative tools required to resolve account-specific or backend-related issues but we’ll continue doing our best to support you within the scope of our responsibilities.

Here are some tips and an example of a prompt to help you navigate the IVR more effectively:

IVR: What kind of problem are you concerned about?

You: Authenticator.

A: What products do you use?

B: Office 365 for business.

Verification: Education or company account?

B: For companies

A: Are you an administrator?

B: Yes.

A: Are there any other administrators in your organization?

B: No.

IVR: Do you need a... Service request?

You: Yes. I need to create a ticket. Please send me directly to the Data Protection Team.

---

Option 2: Create a new tenant to submit a support ticket (Alternative method)

If you cannot reach a live agent, there is still a workaround, you might consider registering for a new tenant by signing up for a trial subscription via this link Microsoft 365 Business Plans and Pricing | Microsoft 365. (please select "Try for free" under a business subscription).

When prompted, enter your email. You can use your personal email or create a new Microsoft personal account for this step.

Then select Set up account to move forward.

From this step, the system should guide you through creating your tenant and assign you a default onmicrosoft.com domain.

Once set up, you can access the admin console of the new tenant and submit a support ticket requesting to speak with the Data Protection team on behalf of your previous tenant.

To create a support ticket: In the Microsoft 365 admin center > Help & Support.

In your ticket description, you'll need to clearly explain that you're trying to regain access to your previous Microsoft 365 tenant and need help from the Data Protection team. Here's a message you can use or adapt:

"Hello, I’m the only global admin, but I'm unable to access my previous Microsoft 365 tenant due to losing MFA access.

I created this new tenant solely to request assistance. I kindly ask to be connected with the Data Protection team to verify my identity and help me recover access to the original tenant.

This is urgent, as I rely on Microsoft 365 for my work and have been unable to operate for several days. I’m available to provide any documentation or verification needed to support the recovery process."

It is important to note: Please remember to turn off recurring billing for the trial subscription once your issue is resolved to avoid any unintended charges. You may prefer the following resource for detailed instructions: Cancel your Microsoft business subscription in the Microsoft 365 admin center | Microsoft Learn.

I hope this helps you regain access to your account quickly. I'm glad to assist and truly hope the information provided has been useful. Please feel free to reach out anytime if you need further assistance.

If you find my post useful, kindly consider upvoting it. Doing so can assist others in the community who may have similar questions in finding solutions more quickly.

Thank you for your kindness and contributions to the forum.

---

If the answer is helpful, please click "Accept Answer". If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in this documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Because the only MFA method was Microsoft Authenticator on a phone that was wiped, and there is no secondary global admin or backup method (SMS/call), the account is effectively locked and self-service recovery isn’t possible. This requires a Microsoft support/Data Protection escalation.

Use the following approach:

1. Confirm there is truly no other global admin
   If any other account in the tenant has Global Administrator rights, that admin can reset MFA so the account can re-register:
   • The other admin signs in to the Azure portal and opens Microsoft Entra ID.
   • Go to Users → select the affected user → Authentication methods.
   • Select Require re-register multifactor authentication.
   • Next sign-in for the affected account will prompt for MFA registration again on the new phone.
2. If there is no other global admin (sole admin scenario)
   In this case, only Microsoft’s Data Protection/Tenant Recovery process can restore access:
   • Call Microsoft support using the Customer service phone numbers - Microsoft Support page (commercial support).
   • In the IVR/with the agent, clearly state:
     • The issue is with Authenticator / MFA.
     • The product is Office 365 for business / Microsoft 365 for business.
     • It is a company account (not personal/education).
     • The caller is the only global administrator and is locked out due to a lost/wiped phone and no backup MFA methods.
     • A Data Protection / Tenant Admin MFA reset is needed.
   • Ask to open a service request and route it to the Data Protection team for tenant admin recovery. Be prepared to provide proof of identity and tenant ownership.
3. If phone support cannot be reached or cannot open a ticket (workaround)
   • Create a new trial Microsoft 365 tenant (separate from the locked one) using any Microsoft 365 business trial plan.
   • Sign in to the new tenant’s Microsoft 365 admin center.
   • Go to Support → Help & support and open a ticket. In the ticket:
     • Explain that access is needed to a different existing tenant where the account is the only global admin and is locked out by MFA.
     • Provide the locked tenant’s domain, admin UPN, and error details.
     • Request escalation to the Data Protection team for MFA reset/tenant admin recovery.
   • After the original tenant is recovered, cancel the trial to avoid charges.

For future protection once access is restored:

• Add at least one additional MFA method (phone call/SMS) and/or a second global admin.
• Consider registering multiple sign-in methods at https://aka.ms/mysecurityinfo so a single device loss does not cause lockout.

---

References:

• Can't set up MFA because five devices are already registered to use an authenticator app
• You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
• Frequently asked questions about Microsoft Entra multifactor authentication
• I need to reset my mfa methods - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• Global Admin Locked out - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A