Locked out of sole Global Admin account due to lost Microsoft Authenticator access - need MFA reset / tenant recovery

Question

Hello Microsoft Team,

I am locked out of my only Global Admin account for tenant [Moderator note: Personal information removed].onmicrosoft.com because Microsoft Authenticator MFA is no longer accessible after changing/losing my previous phone.

Account: [[Moderator note: Personal information removed].onmicrosoft.com]

I still know the password, but:

I cannot approve Authenticator prompts

I do not have a usable verification code

“Sign in another way” still only points to Microsoft Authenticator

I have no other Global Admin account to reset MFA

I have order number / proof of purchase and can provide ownership verification.

Please escalate this to the Microsoft Data Protection / Tenant Recovery team for MFA reset / re-registration recovery.

Thank you.

Answer 1

Hello @Chandra Sihombing,

Thank you for your response.

When contacting the support team, you can select any region that supports your preferred language, as Microsoft provides support across multiple regions and languages. They're listed in the document I provided in my initial response.

If you still prefer to contact them by email, you can try creating a support ticket from a Microsoft 365 tenant. If you do not have access to any existing tenant, you may create a trial tenant and submit the support request from there.

To set up a new trial tenant and submit your support request, please follow these steps:

• Visit the Microsoft 365 Enterprise Plans page: Go to Compare Office 365 Enterprise Pricing and Plans | Microsoft 365.    
• Choose a plan and start a free trial: Select any of the available plans and click "Try for free" to begin the trial setup process.     

• Follow the guided setup: Complete the steps to create a new Microsoft account and a new tenant. This will be a separate and independent Microsoft 365 environment.    
• Access the Microsoft 365 Admin Center: Once the new tenant is created, navigate to https://admin.microsoft.com/.    
• Go to Support:   
  • Click on "Help & Support" button like this image. 
  
  • Toggle Support Assistant option to OFF > Type your issue under "How can we help?" Box > click Get Help. 
  • The Contact Support button will become available, you can click on it now. 
  
  • Choose contact method: "Email"      
  
• Raise a support ticket: Describe your issue in detail. Crucially, you must clearly state that you are locked out of a different, pre-existing Microsoft 365 tenant where you are the administrator. Provide the following information about your locked account:      
• The domain name of your locked tenant     
  • Your administrator account. 
  • Any error messages you are receiving.    
  • Details about the authentication issues you are experiencing.    
  • Your proof of ownership. 
  
  • Finally, clicking on "Contact me".   

Important notes:

• This new trial tenant will not give you access to any of the data or settings in your original locked tenant. It is solely a temporary means to contact Microsoft support.  
• Be prepared for Microsoft support to ask for verification of your identity and administrative rights for the locked tenant. 
• The resolution time might be longer as you are contacting support from a different tenant.    
• Remember to cancel the trial subscription for the new tenant once your issue with the original account is resolved to avoid any unintended charges. You can typically do this within the Microsoft 365 Admin Center under "Billing" -> "Your products."  

I hope you'll be able to reach the Data Protection team this way. If you still have any issue, please don't hesitate to reply.

Answer 2

Hello @Chandra Sihombing, 

I'm sorry to hear that the Only Admin account is locked out.

To help guide you correctly, please confirm how the your service was purchased: 

If it was purchased through a seller or Microsoft partner, please contact the seller or partner who provided the subscription. They can: 

• Identify the tenant administrator 
• Assist with account recovery or escalation 

If the subscription was purchased directly from Microsoft and there is no other administrator available, as you’re aware, account recovery must be handled by Microsoft Data Protection team.

In this situation, please submit a support request with them directly. As a forum moderator, I don’t have the ability to escalate cases on your behalf. Contacting the Data Protection team directly is the best approach and will help ensure the recovery process moves forward smoothly.

You can find the related hotline number to call the frontline and let them raise a ticket for you: Customer service phone numbers - Microsoft Support 

Please carefully follow this instruction to ask for Microsoft Data Protection team support:   

Depending on your country or region. For some countries, when calling the support number, although there are about 30 seconds opening as something "you can visit the link...." But you can ignore this opening and wait until the option, then "1" as a business email user, "1" again for technical help.   

For some countries, it will be an automated conversation like:    

• First, when you call the hotline, it asks what kind of problem you are worried about.   
• Answered: authenticator.   
• A: What kind of product are you using?   
• B: Microsoft 365 for Business.   
• A confirmation: education or company account?   
• B: For companies   
• A: Are you an administrator?   
• B: Yes.   
• A: Do you have the other admin in your organization?   
• B: No.   
• A: You need one.... Service request?   
• B: Yes   

Please understand that forum moderators have no control over user accounts, especially when it comes to logging in to your account, resetting your password, changing your access, etc.   

If you encounter any difficulties in contacting the frontline support, please feel free to let me know. Thank you and I wish you a great day!  

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Because the only Global Administrator is locked out and cannot complete MFA, the next step is to work with Microsoft’s Data Protection/Tenant Recovery team. Forum moderators and standard support channels cannot directly reset MFA or bypass verification.

Follow these steps to regain access:

1. Contact Microsoft Data Protection by phone (primary path)
   • Call Microsoft customer service for the region using the numbers listed under Customer service phone numbers - Microsoft Support.
   • When connected to the IVR/agent, clearly state:
     • The issue is with Microsoft Authenticator / MFA.
     • The product is Office 365/Microsoft 365 for business.
     • The account is a company/organization account.
     • There is only one Global Administrator on the tenant and that admin is locked out due to lost Authenticator access.
     • A Data Protection / Tenant Recovery case is needed to reset MFA / security info for the sole Global Admin.
   • Be prepared to provide tenant details (tenant name like .onmicrosoft.com), admin UPN, order number, and any proof of purchase or ownership requested so the Data Protection team can verify identity and ownership.
2. If phone support is hard to reach: create a temporary trial tenant to open a ticket
   • Sign up for a new Microsoft 365 trial tenant (a separate environment).
   • In that new tenant, go to the Microsoft 365 admin center → Support → Help & support.
   • Open a support ticket explaining:
     • The ticket is about a different existing tenant where the requester is the sole Global Admin.
     • MFA is enforced and the only method was Microsoft Authenticator on a lost/replaced phone.
     • The admin knows the password but cannot pass MFA and cannot access the original tenant’s admin portal to open a ticket.
     • Request escalation to the Microsoft 365 Data Protection team to perform MFA reset / re-registration for the Global Admin of the locked tenant.
   • Provide the locked tenant’s domain, admin UPN, and any purchase/ownership information the support engineer requests.
3. If the tenant is managed via a partner (CSP/Indirect provider)
   • If a Cloud Solution Provider or partner manages the subscription, contact the partner and ask them to open a Data Protection service request on behalf of the tenant, stating that the sole Global Admin is locked out due to MFA.

Only the Microsoft Data Protection team (or a partner with appropriate delegated admin rights in some scenarios) can verify ownership and reset MFA/security info when there is no other Global Admin available. Once they complete verification, they will help restore access so MFA methods can be re-registered on the new device.

---

References:

• Troubleshoot sign-in issues and account access problems
• Tenant Lockout: Scenarios & Next Steps
• Troubleshoot Microsoft verification code issues
• Global Admin Locked out - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A