Lost MFA for Azure Global Admin

Question

Hello,

I own a domain that had an azure account that was a global admin. It was setup with Microsoft authenticator only as the MFA method, I have gotten a new phone and for some reason Microsoft authenticator did not transfer across and can no longer login to the azure account as I don't have access to the authenticator anymore. Is there a way this can be resolved? I own the domain.

---

Moved from: Microsoft Security | Microsoft Authenticator

Answer 1

Hello @aaronpw,

Regarding the issue where you are having issue with MFA for Azure portal login. Please kindly check whether your tenant has another Global Administrator who may be able to assist you with this issue?   

If other user still holds the Global Administrator role, please kindly follow these steps: 

• Sign in to the Microsoft Entra Admin Center using an account that has at least the Authentication Administrator role. 
• Navigate to Entra ID > Users.  
• Select the user whose MFA authentication methods you wish to reset, then choose Authentication methods.  
• Select Revoke multifactor authentication sessions, and then select Require re‑register multifactor authentication.  
• After completing these steps, the user will need to set up MFA again. You can do this by signing in and configuring MFA through the Microsoft Authenticator app on mobile device. 

If you are the only administrator in your organization, you will need to contact the Microsoft Data Protection team for further assistance. Please locate the appropriate support phone number for your country or region and contact Microsoft Support so the frontline team can raise a service request on your behalf: Customer service phone numbers 

When calling the support number, the experience may vary depending on your country or region: 

• In some regions, you may hear an automated message for approximately 30 seconds. You can ignore this message and wait for the prompt, then select “1” for Business email user and “1” again for Technical support. 
• In other regions, you may be guided through an automated conversation similar to the following: 
  • The system asks what issue you are experiencing > Authenticator 
  • Account type > Company account 
  • Administrator status > Yes 
  • Are there other administrators in the organization? > No 
  • Proceed to create a service request > Yes  

Alternatively, if you are unable to reach support by phone, you may create a temporary trial tenant to submit a support request for the block access tenant through the Microsoft 365 admin center. You can start with a trial license here: Microsoft 365 Business Plans and Pricing | Microsoft 365  

Important: Please remember to cancel the trial subscription after your original account issue is resolved to avoid any future charges. 

Note: Please understand that as forum moderator, our primary goal is to provide helpful guidance and support through general troubleshooting steps. While we don’t have access to internal systems or test devices required to resolve backend/account issues, we truly appreciate your understanding of these limitations. we genuinely hope the information helps you in the right direction, and we are always here to assist as much as we can within our scope. 

I hope the above methods will be able to assist you in restoring access.   

Thank you for your patience and understanding. I hope the information above is helpful. If you have any further questions, please feel free to reach out.

Answer 2

Because the only registered MFA method was Microsoft Authenticator on a phone that is no longer available, recovery depends on whether there is another Global Administrator in the tenant.

1. If there is another Global Administrator
   That admin can reset the MFA registration so the affected account can set up Authenticator again:
   1. The other Global Admin signs in to the Azure portal and opens Microsoft Entra ID.
   2. Go to Users and select the locked-out admin account.
   3. Open Authentication methods.
   4. Select Require re-register multifactor authentication.
   5. Next time the locked-out admin signs in, they will be prompted to register MFA again on the new phone.
2. If there is no other Global Administrator (only one Global Admin and it is locked out)
   This is a tenant lockout scenario. In this case, recovery must be handled by Microsoft Support’s Data Protection/Tenant Recovery team. The typical paths are:
   • Contact Microsoft Support by phone (recommended) and request escalation to the Data Protection team for a tenant admin MFA reset/tenant recovery. During the call, clearly state:
     • It is an Azure/Microsoft 365 for business/organization account.
     • MFA is required and the only method was Microsoft Authenticator on a lost/replaced phone.
     • There is no other Global Administrator.
   • If reaching a live agent is difficult, one documented workaround is to:
     1. Create a new trial Microsoft 365/Azure tenant.
     2. Use that new tenant’s admin portal to open a support ticket.
     3. In the ticket, request to speak with the Data Protection team on behalf of the original tenant that is locked out and provide proof of domain/tenant ownership.

The Data Protection team will verify ownership of the tenant (using domain and business documentation) and then reset or re-register MFA for the Global Admin so access can be restored. Community answers show this process can take several days and involves back‑and‑forth verification, but it is the supported route when the only Global Admin is locked out due to lost Authenticator access.

To prevent future lockouts, once access is restored, configure:

• Multiple MFA methods (e.g., Authenticator + phone/SMS + security key), and
• At least one additional Global Admin or a break-glass account with alternative MFA.

---

References:

• Can't use Azure Multi-Factor Authentication to sign in to cloud services after you lose your phone or the phone number changes
• You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
• Global Admin Locked out - Microsoft Q&A
• How Do I Regain Access to My Account After Losing Access to Microsoft Authenticator? (Urgent Request). - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• Common problems with two-step verification for a work or school account
• Use a screen reader to set up and troubleshoot multifactor authentication