Locked out of Microsoft 365 admin account — circular recovery loop

Question

I am locked out of my Microsoft Exchange admin account. When I attempt a password reset, phone verification is successful, but the secondary verification method required is an alternate email — which is the same email account I am trying to recover. This creates a circular loop with no way out.

I do not have another Global Admin on the tenant. I cannot access the admin center. I cannot reach live support without being signed in.

I can prove ownership of the domain via DNS if required. I have billing information and subscription details available.

What is the correct process to recover admin access in this situation?

Answer 1

Please understand that as forum moderators, we do not have the tools or sufficient access to make changes to user accounts, including logging in, resetting passwords, or modifying access rights. For your security, only Microsoft Support can assist with these requests.  

Hello @cvhpcapinfo,

Thank you for reaching out.

Since you are the only admin, you will need to contact Microsoft’s Data Protection team. This team has the authority and the specific security procedures to verify your identity as the legitimate owner of the account and then reset your MFA settings from their end. Please try to find the related hotline number to call the frontline and let them raise a ticket for you: Customer service phone numbers - Microsoft Support   

Here are some tips and an example of a prompt to help you navigate the IVR more effectively:   

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help)        

In some regions you may initially interact with an automated system, so here is an example of how you can answer the prompts to reach the right team more quickly:   

• What kind of problem are you experiencing?           
• Answer: Authenticator           
• What products do you use?           
• Answer: Office 365 for business           
• Is this for an education or company account?           
• Answer: For companies           
• Are you an administrator?           
• Answer: Yes           
• Are there any other administrators in your organization?           
• Answer: No. I am the only admin in my tenant            
• Do you need a... Service request?            
• Answer: Yes. I need to create a ticket. Please send me direct to the Data Protection Teams.        

During the call, you will be asked to provide information that verifies your identity and proves ownership of the tenant, such as your organization name, billing information, contact email, phone number, or other subscription‑related details.

---

If you are unable to reach support via the phone numbers, there is a workaround you might consider: You can register for a new Microsoft 365 tenant by signing up for a trial subscription here: Microsoft 365 Business Plans and Pricing | Microsoft 365    

Once the new tenant is created, you can access the admin center and submit a support ticket from there, requesting to speak with the Data Protection Team on behalf of your original tenant.    

Important notes:     

• This new trial tenant will not give you access to any of the data or settings in your original locked tenant. It is solely a temporary means to contact Microsoft support.    
• The resolution time might be longer as you are contacting support from a different tenant.    
• Remember to cancel the trial subscription for the new tenant once your issue with the original account is resolved to avoid any unintended charges.  

I hope the information provided helps guide you in the right direction. Although I’m unable to take direct action, I sincerely hope that the steps and recommendations I’ve shared can support you through the process.  

Warm regards, 

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

In this situation, recovery must go through Microsoft’s data protection/support channels because there is no other global admin and self-service recovery is blocked by the circular verification.

Use the following process, depending on how the tenant is set up:

1. Confirm there is truly no other global admin
   If there were another global admin, that account could reset the password or MFA and update your security info. Since there is not, proceed to Microsoft support/data protection.
2. If the company has no other global admin on the account
   Follow the guidance for “You’re the only global admin on the account” / “Your company doesn’t have a global admin”:
   • Contact the appropriate Microsoft Data Protection team by phone.
     Use the regional phone numbers listed under Get support - Microsoft 365 admin / Support for Business Products to reach support, then request transfer to the Microsoft 365 Data Protection team.
   • Clearly state:
     • This is a business/organization Microsoft 365 tenant.
     • You are the only global admin.
     • You are locked out due to recovery requiring the same admin mailbox as the secondary verification method.
   • Be prepared to prove tenant ownership (domain DNS control, billing details, subscription information, etc.) when the Data Protection team validates identity.
   The Data Protection team has specific tools and processes to verify identity and reset the admin password or MFA when no other global admin is available.
3. If the tenant is through a partner / CSP
   • If the subscription came from a Cloud Solution Provider (CSP) or other Microsoft partner, contact that partner.
   • The partner can use their granular delegated admin privileges (GDAP) and appropriate roles to reset the admin password or create a new global admin for the tenant.
   • If the partner does not have password-reset roles, they must help you use the self-service password reset tool or help you contact Microsoft support as the end-customer global admin.
4. If absolutely no signed-in account can open a ticket
   • Use the public Support for Business Products phone numbers to reach Microsoft support without signing in, and request escalation to the Microsoft 365 Data Protection team for a tenant lockout / admin lockout scenario.
5. What Microsoft will typically do
   • Verify that there is no other global admin with access.
   • Validate your identity and tenant ownership (domain verification, billing, company information).
   • Once validated, reset the admin credentials or grant a new global admin so you can sign in and correct your security information (alternate email, phone, MFA methods) to prevent future lockouts.

Self-service tools (passwordreset.microsoftonline.com, standard “Forgot password” flows) are not sufficient in this circular verification scenario; resolution requires direct engagement with Microsoft support/Data Protection or a partner with GDAP and the right roles.

---

References:

• Troubleshoot sign-in issues and account access problems
• Preventing tenant lockouts
• All about passwords
• "We could not verify your account" error when you try to reset your admin password in Microsoft 365, Intune, or Azure