Azure MFA locked out

Question

I am unable to access my Azure portal because MFA is not working.

I am the only Global Administrator on this tenant and have no alternative authentication method available.

I cannot sign in to create a support request through the Azure portal.

There is also active billing on the subscription that I cannot manage due to being locked out.

Please escalate this case to the Data Protection / Tenant Recovery team to verify ownership and reset MFA for my admin account.

Answer 1

Because there is only one Global Administrator on the tenant and no working MFA or alternate authentication method, this is a tenant lockout scenario that must be handled by Microsoft’s Data Protection / Tenant Recovery team.

Follow these steps to regain access:

1. Contact Microsoft support by phone
   • Use the regional phone numbers listed under Customer service phone numbers - Microsoft Support / Support for Business Products / Microsoft 365 for business support phone numbers by country or region.
   • When navigating the IVR, clearly indicate:
     • The product: “Office 365 for business” or “Azure / Microsoft 365 for business”.
     • That this is a company/organization account.
     • That you are an administrator.
     • That there is no other global administrator.
     • That you are locked out due to MFA and need to be connected to the Microsoft Data Protection team (sometimes called Tenant Recovery) to reset MFA for the only Global Admin.
2. Ask specifically for Data Protection / Tenant Recovery
   • Explain that:
     • MFA is required and is not working.
     • You are the only Global Administrator.
     • You cannot access the Azure/Microsoft 365 admin portals to open a ticket.
     • There is active billing you cannot manage.
   • The frontline agent must create a service request and route it to the Data Protection team, who have tools and processes to verify tenant ownership and reset the admin’s authentication methods.
3. If phone support cannot be reached
   • As an alternative, create a temporary trial tenant (for example, a Microsoft 365 or Azure trial) and use that tenant’s admin center to open a support ticket.
   • In the ticket, clearly state that:
     • The issue concerns a different existing tenant where you are the only Global Admin.
     • You are locked out due to MFA and need MFA reset / admin recovery by the Data Protection team.
   • Be prepared to provide proof of ownership and business documentation for the locked tenant.
4. After recovery
   • Once access is restored, configure:
     • At least two Global Administrator accounts with different credentials and MFA methods.
     • Emergency/break-glass accounts excluded from Conditional Access policies, with strong passwords and monitored sign-ins.
   • This prevents future tenant lockouts caused by MFA or policy issues.

The actual MFA reset and tenant recovery can only be performed by Microsoft support (Data Protection team); community forums and tools cannot override MFA or admin access in this scenario.

---

References:

• Troubleshoot sign-in issues and account access problems
• Mandatory multifactor authentication for Azure and admin portals
• Preventing tenant lockouts
• Tenant Lockout: Scenarios & Next Steps
• You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
• "Activation failed" error when you try to set up Azure Multi-Factor Authentication
• Global Admin Locked out - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A