Unable to Access O365 admin Accounts Due to 2FA and Credential Issues

Question

Dear Team,

I recently created a business domain account in Office 365 with the username [Moderator note: personal info removed]@techandsupport.onmicrosoft.com

I have the login credentials for this account; however, I accidentally removed the two-factor authentication (2FA) setup from the Microsoft Authentication app

Now, when I try to sign in using my username and password, I am prompted to verify my identity using one of the following options:

Approve a request on the Microsoft Authentication app

Use a verification code

Since the Authentication app was removed, I no longer have access to both the option.

Additionally, I created another global admin account with the username [Moderator note: personal info removed]@techandsupport.com and assigned Business Basic license.

Unfortunately, I do not remember the temporary credentials for this account.

When I attempt to reset the password using the "Forgot Password" option, I receive the following message:

"You can't reset your own password. If you can't sign in, you must contact your administrator to reset your password for you."

As there are no other administrators available, I am unable to proceed. I have configured my personal Gmail ID as the alternate email in both the accounts.

I kindly request your assistance in resolving these issues and helping me regain access to both accounts.

Thank you for your support.

Best regards,

[Moderator note: personal info removed]

Answer 1

Dear @Vijay Kumar Parmar,

Based on your description, I understand how urgent this situation must feel, especially since you’re the administrator and need to manage your subscription. Please know you’re not alone in this, and I’ll guide you through every step to get you back in control as quickly as possible.

Option 1: Other Admin can revoke MFA sessions and require re-registration in Microsoft Entra admin center.

If you are user or have other admins in your company, to regain access to your account, I recommend you contact your IT admin/Global admin to raise a request for resetting your authentication method in the Entra admin center.

For step-by-step details, refer to the official Microsoft documentation: Manage authentication methods for Microsoft Entra multifactor authentication - Microsoft Entra ID | Microsoft Learn  

Option 2: Contact Microsoft Data Protection Support by Phone  

Since you are the administrator and are locked out, the most direct method is to call Microsoft's support line to raise a request for resetting your authentication method. For a full list of regional numbers, you can also visit this official page: Customer service phone numbers - Microsoft Support. The support team will assist you as soon as possible. For reference:  Get support | Microsoft Docs   

Here are some tips and an example of a prompt to help you navigate the IVR more effectively: 

In some countries, it is an automated conversation like: First, when you call the hotline, it will be asked as follows: 

IVR: What kind of problem are you concerned about? 

You: Authenticator. 

IVR: What kind of product do you use? 

You: Office 365 for business. 

IVR confirmation: education or company account? 

You: For companies 

IVR: Are you an administrator? 

You: Yes. 

IVR: Do you have the other administrator in your organization? 

You: No. 

IVR: Do you need a... Service request? 

You: Yes  

This process should connect you with a live agent who will create a service request with the Data Protection team. They will then contact you to help you regain access. 

Option 2: Create a Temporary Account (Trial Tenant) to Submit a Support Ticket 

If you have difficulty reaching an agent by phone, there is a reliable workaround. This involves creating a new, temporary Microsoft 365 account to contact the support team online. 

• Sign up for a new Microsoft 365 Business trial using this link: Compare All Microsoft 365 Plans. You will need to use a different, personal email address to register. 
• Once the trial account is created, log in to its Admin Center. 
• From the Admin Center, open a new Service Request. For reference:  Get support | Microsoft Docs   
• In the ticket description, explain that you are locked out of your primary tenant (your.onmicrosoft.com) and that you need to speak with the Data Protection team to regain access. Provide your locked account's details and a good contact number for them to reach you. 

Important: Please remember to cancel the trial subscription after your original account issue is resolved to avoid any future charges. 

I am confident that the Data Protection team can resolve this for you. Please try the phone option first, as it is the most direct path. Let me know if you have any questions about these steps. 

Note: Please understand that as a forum moderator, my role is to provide general guidance and troubleshooting support. I don’t have access to internal systems or backend tools, and I appreciate your understanding of these limits.

I hope the information shared helps point you in the right direction. Please try the steps above and let me know if they work. If not, we can continue working together to narrow this down.

The first response may not always resolve the issue right away, but with your help and more details, we can work toward a solution.

Thank you for your patience and understanding. I'm looking forward for your reply.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

For a business tenant where all global admins are locked out by MFA or password issues, recovery must be handled by Microsoft support/Data Protection. This cannot be fixed from the portals or by self‑service.

Given the situation:

• Primary global admin *@techandsupport.onmicrosoft.com is blocked by Microsoft Authenticator MFA, and the app registration was removed.
• Secondary global admin *@techandsupport.com exists but its password cannot be reset because self‑service password reset is not allowed and there is no other admin.

The only supported path is to involve Microsoft support so the Data Protection team can verify identity and reset the admin’s authentication methods.

Use these steps:

1. Contact Microsoft support by phone (primary method)
   • Call the Microsoft global customer service number for the region: see Customer service phone numbers - Microsoft Support in the referenced articles.
   • When the IVR/bot asks what the problem is, clearly indicate it is an Authenticator / MFA / lost admin access issue for Office 365 for business.
   • When prompted:
     • Choose options for business email user and technical support (for many regions this is 1 then 1).
     • When asked what product: answer Office 365 for business.
     • When asked account type: answer company account.
     • When asked if an administrator: answer Yes.
     • When asked if there is another administrator: answer No.
     • Confirm that a service request is needed and ask to be routed to the Data Protection team.
   • Clearly state:
     • You are the only global administrator for the tenant.
     • You are locked out because of MFA (Microsoft Authenticator) removal on the primary admin and no password reset possible on the second admin.
     • Provide tenant details (domain names techandsupport.onmicrosoft.com and techandsupport.com, admin UPNs, and the alternate Gmail address configured on the accounts) when requested.
   • The Data Protection team will guide through identity verification and, once satisfied, can reset MFA methods or help regain access.
2. If phone support is hard to reach: create a temporary trial tenant to open a ticket
   • Sign up for a new Microsoft 365 trial tenant (any business/enterprise trial plan) as described in the Q&A guidance.
   • After the trial tenant is created, go to the Microsoft 365 Admin Center for that new tenant.
   • Use Help & support to open a support ticket.
   • In the ticket, clearly explain:
     • This new tenant is only for contacting support.
     • The real problem is with a different existing tenant (techandsupport.onmicrosoft.com / techandsupport.com).
     • You are the sole global admin of that original tenant and are locked out due to MFA and password reset restrictions.
   • Ask explicitly to be connected with the Microsoft 365 Data Protection team to perform an admin MFA reset / account recovery on the original tenant.
   • After the issue is resolved and access is restored, cancel the trial subscription on the temporary tenant to avoid charges.
3. After access is restored (hardening recommendations)
   • Sign in as global admin and:
     • Add at least one additional global admin account with working MFA.
     • Configure multiple MFA methods (Authenticator, SMS, phone call, security key) for each admin.
     • Verify alternate email/phone details for account recovery are correct.

Self‑service options (password reset, changing MFA, etc.) cannot bypass the current lock because:

• MFA prompts cannot be satisfied (Authenticator removed, no code).
• The second admin’s password cannot be reset without another admin.

Only Microsoft support/Data Protection can override this in a secure way.

---

References:

• I can't sign in to my Microsoft account
• You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• I cant log in to my business account because it is requiring Authenticator app which I do not have - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A