Locked Out of Microsoft Entra ID Tenant – MFA Recovery Assistance Needed

Question

Hello Team,

I had a Microsoft Entra ID Free subscription set up for personal testing. Unfortunately, I have lost access to my MFA devices and am now locked out of the tenant.

I would appreciate your guidance on the best way to recover access, as I have a couple of custom domains registered with this tenant.

Please let me know what steps I can take to resolve this issue.

Thank you in advance for your support.

Answer 1

Please understand that as forum moderators, we do not have the tools or sufficient access to make changes to user accounts, including logging in, resetting passwords, or modifying access rights. For your security, only Microsoft Support can assist with these requests. 

 

Hello @Sonu Kumar,

Thank you for reaching out.

Could you please help me confirm whether there is another active Global Administrator in your organization? If there is, they can revoke and require re-registration of Multi-Factor Authentication (MFA) settings for your account by following these steps: 

• Signing in to the Microsoft Entra Admin Center
• Navigating to Users > Your Account > Authentication methods  
• Selecting Require re-register MFA  

Once this is completed, you will be prompted to set up MFA again during your next login 

 

If you are the only admin: 

You will need to contact Microsoft’s Data Protection team. This team has the authority and the specific security procedures to verify your identity as the legitimate owner of the account and then reset your MFA settings from their end. Please try to find the related hotline number to call the frontline and let them raise a ticket for you: Customer service phone numbers - Microsoft Support    

Here are some tips and an example of a prompt to help you navigate the IVR more effectively:  

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)    

In some regions, the initial interaction may be automated, so here’s a general idea of how the conversation might go to help you prepare:      

• What kind of problem are you experiencing?         
• Answer: Authenticator         
• What products do you use?         
• Answer: Office 365 for business         
• Is this for an education or company account?         
• Answer: For companies         
• Are you an administrator?         
• Answer: Yes         
• Are there any other administrators in your organization?         
• Answer: No. I am the only admin in my tenant          
• Do you need a... Service request?          
• Answer: Yes. I need to create a ticket. Please send me direct to the Data Protection Teams.      

During the phone call, you will need to provide the information associated with your subscription, such as your company name, billing details, phone number, and an alternate email address, etc. This information allows the Data Protection team to verify your identity and securely assist you in regaining access to your administrator account. 

---

If you are unable to reach support via the phone numbers, there is a workaround you might consider: You can register for a new Microsoft 365 tenant by signing up for a trial subscription here: Microsoft 365 Business Plans and Pricing | Microsoft 365    

Once the new tenant is created, you can access the admin center and submit a support ticket from there, requesting to speak with the Data Protection Team on behalf of your original tenant.    

Important notes:     

• This new trial tenant will not give you access to any of the data or settings in your original locked tenant. It is solely a temporary means to contact Microsoft support.    
• The resolution time might be longer as you are contacting support from a different tenant.    
• Remember to cancel the trial subscription for the new tenant once your issue with the original account is resolved to avoid any unintended charges.  

I hope the information provided helps guide you in the right direction. Although I’m unable to take direct action, I sincerely hope that the steps and recommendations I’ve shared can support you through the process.  

  

Warm regards, 

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Because the tenant is now inaccessible due to loss of all MFA methods and there is no other administrator who can reset MFA, recovery must go through Microsoft support and the Data Protection/Tenant Recovery process.

Use the following approach:

1. If there is another global administrator in the tenant
   • That admin signs in to the Azure portal and opens Microsoft Entra ID.
   • Go to Users → select the locked-out account → Authentication methods.
   • Use Require re-register multifactor authentication so the account is prompted to set up MFA again on next sign-in.
   • Sign in again and register new MFA methods (for example, Microsoft Authenticator, phone, or a more secure method like passkey or certificate-based authentication as described in Mandatory multifactor authentication for Azure and admin portals).
2. If there is no other global administrator (only admin is locked out)
   • This is a tenant lockout scenario. Forum moderators and normal tools cannot fix it.
   • The tenant administrator must contact Microsoft support so the Data Protection team can verify identity and restore access:
     • Use the appropriate customer service/global support phone numbers listed in the documentation (for example, the links under “global support phone numbers” or “Customer service phone numbers - Microsoft Support”).
     • Clearly state that this is a tenant lockout and that the caller is the only global administrator who has lost MFA access.
   • The Data Protection team has dedicated processes to:
     • Reset credentials of an administrator account.
     • Help regain access to a tenant owned by the organization.
   • If the tenant was created via a partner/reseller, that partner can also open a support request on behalf of the tenant, as described in the tenant lockout guidance.
3. If direct support access is blocked by the lockout
   • One documented workaround is to create a separate, temporary Microsoft 365/Azure trial tenant solely to open a support ticket:
     • Create a new trial tenant.
     • Go to the admin/support area in that new tenant and open a support request.
     • In the ticket, clearly specify that the issue is with a different existing tenant where the caller is the locked-out global admin, and provide:
       • Admin UPN of the locked tenant.
       • Tenant domain(s) (including the custom domains registered there).
       • Error messages and description of the MFA lockout.
   • This trial tenant does not give access to the original tenant’s data; it is only a channel to reach support. Remember to cancel the trial after the issue is resolved.
4. After Microsoft restores access
   • Sign in and immediately:
     • Register multiple MFA methods (Authenticator, phone, and preferably higher-assurance methods such as passkeys or certificate-based authentication).
     • Consider enabling account recovery/identity verification features so future MFA loss can be handled more smoothly.
     • Verify that custom domains and tenant access are intact.

Because the subscription is Microsoft Entra ID Free and there is no portal access, the only supported path to recover a locked global admin account with no remaining MFA methods is through Microsoft support and the Data Protection/Tenant Recovery process.

---

References:

• Discover your Microsoft cloud footprint FAQ
• Mandatory multifactor authentication for Azure and admin portals
• Common problems with two-step verification for a work or school account
• Recover user authentication methods using Microsoft Entra Backup and Recovery (Preview)
• Preventing tenant lockouts
• Global Admin Locked out - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A
• You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
• 7 Day Old Azure Account: AADSTS5000225: This tenant has been blocked due to inactivity. - Microsoft Q&A