Global Admin Account Recovery for my Entra ID tenant

Question

Global Admin Account Recovery for my Entra ID tenant

Anshul Sekhri 0

Hello, I need a Global Admin Account Recovery for my Entra ID tenant.

The only Global Admin account is: ******@xxxxxxxxx.onmicrosoft.com

The tenant domain is: xxxxxxxxx.onmicrosoft.com

This account is locked behind MFA, and there are no alternate authentication methods, no custom domain, and no other admin accounts in the tenant. Please advise on the next steps.

I'm stuck in a loop. I try to login to MS 365 Admin center using my ******@xxxxxxxxx.onmicrosoft.com account and it asks me to enter code from the authenticator App. When i go to the authenticator app, I see on the authenticator app its asks me to sign in to ******@xxxxxxxxx.onmicrosoft.com, and when I try to do so, it accepts the password but again asks me to enter the code from the authenticator app.

Sridevi Machavarapu 33,740 Reputation points Microsoft External Staff Moderator

2026-04-16T20:41:00.8+00:00

Hello Anshul Sekhri,

Based on the details you’ve shared, this appears to be a tenant lockout scenario.

To resolve this, the recommended approach is to contact the Microsoft Data Protection team. You can reach them by calling Microsoft Customer Service using the phone numbers listed here: Customer service phone numbers - Microsoft Support

If you have access to another tenant or subscription where you still have Global Administrator privileges, you may also raise a support request from there to get assistance in restoring access to the affected tenant.

For future reference and to help prevent tenant lockouts, please check: Preventing Tenant Lockouts - Partner Center | Microsoft Learn

If neither option is possible, please don’t worry—let us know, we are happy to assist you further!
Sridevi Machavarapu 33,740 Reputation points Microsoft External Staff Moderator

2026-04-17T18:18:20.6+00:00

Hello Anshul Sekhri,

Any update on this? Please confirm here if issue still persists!
Nicole Kuonen 20 Reputation points

2026-06-03T05:18:53.42+00:00

Hello @Sridevi Machavarapu

I have the exact same problem: Business Account, only one admin account, only Authenticator app as MFA and this authentification is not possible due to phone loss --> so tentant lockout scenario. I tried calling Microsoft support multiple times, but I can't get thru to an agent. The AI voice is not getting me the support I need and is not redirecting me to Data Protection Team to start the recovery process. I tried using different vocabulary, but she doesn't get, what I mean.

Is there any other way to contact the Data Protection Team?

Best regards,

Nicole
Sridevi Machavarapu 33,740 Reputation points Microsoft External Staff Moderator

2026-06-03T06:51:43.2133333+00:00

Hello Nicole Kuonen,

Please create a new Q&A post at https://learn.microsoft.com/en-us/answers/questions/ask/ and select the Microsoft Security | Microsoft Entra | Microsoft Entra ID tag when submitting your question and tag me over new post.

1 answer

Your answer

Sridevi Machavarapu 33,740 Reputation points Microsoft External Staff Moderator

2026-04-16T20:41:00.8+00:00

Hello Anshul Sekhri,

Based on the details you’ve shared, this appears to be a tenant lockout scenario.

To resolve this, the recommended approach is to contact the Microsoft Data Protection team. You can reach them by calling Microsoft Customer Service using the phone numbers listed here: Customer service phone numbers - Microsoft Support

If you have access to another tenant or subscription where you still have Global Administrator privileges, you may also raise a support request from there to get assistance in restoring access to the affected tenant.

For future reference and to help prevent tenant lockouts, please check: Preventing Tenant Lockouts - Partner Center | Microsoft Learn

If neither option is possible, please don’t worry—let us know, we are happy to assist you further!
Sridevi Machavarapu 33,740 Reputation points Microsoft External Staff Moderator

2026-04-17T18:18:20.6+00:00

Hello Anshul Sekhri,

Any update on this? Please confirm here if issue still persists!
Nicole Kuonen 20 Reputation points

2026-06-03T05:18:53.42+00:00

Hello @Sridevi Machavarapu

I have the exact same problem: Business Account, only one admin account, only Authenticator app as MFA and this authentification is not possible due to phone loss --> so tentant lockout scenario. I tried calling Microsoft support multiple times, but I can't get thru to an agent. The AI voice is not getting me the support I need and is not redirecting me to Data Protection Team to start the recovery process. I tried using different vocabulary, but she doesn't get, what I mean.

Is there any other way to contact the Data Protection Team?

Best regards,

Nicole
Sridevi Machavarapu 33,740 Reputation points Microsoft External Staff Moderator

2026-06-03T06:51:43.2133333+00:00

Hello Nicole Kuonen,

Please create a new Q&A post at https://learn.microsoft.com/en-us/answers/questions/ask/ and select the Microsoft Security | Microsoft Entra | Microsoft Entra ID tag when submitting your question and tag me over new post.

Answer 1

Because the only Global Administrator is locked behind Microsoft Authenticator with no alternate methods and no other admins exist in the tenant, this is a tenant lockout scenario that cannot be resolved through self-service or portal actions.

Next steps are:

Use Microsoft’s Data Protection / Tenant Recovery support
- This situation matches the documented tenant lockout and “only global admin” scenarios where Microsoft must verify identity and ownership before resetting access.
- Contact Microsoft support via the business support phone channel listed under Customer service / Microsoft 365 for business and clearly state:
  - It is a Microsoft 365/Entra ID business tenant.
  - The only Global Administrator is locked out due to MFA with no alternate methods.
  - There are no other admins and no custom domain.
- Ask to be routed to the Microsoft 365 Data Protection team (also referred to as Data Protection / Tenant Recovery) to perform admin/MFA reset after identity verification.
Be prepared for identity verification
- Support may request:
  - Proof of organization ownership (business registration, tax or incorporation documents).
  - Proof of domain or tenant ownership (for example, information about the onmicrosoft.com tenant and any associated billing/subscription details).
- All tenant ownership and access decisions are handled only through Microsoft 365 support; other programs (such as Microsoft for Nonprofits) cannot bypass this process.
If front-line support misroutes the case
- If initial agents say they cannot help or treat the account as non-admin, insist on opening a service request for a tenant lockout and ask specifically for escalation to the Data Protection team, as shown in the referenced Q&A resolutions.
Optional fallback if unable to reach the correct team
- Some documented resolutions suggest creating a separate trial Microsoft 365 tenant, using its admin center to open a support ticket, and requesting Data Protection assistance for the original locked tenant. This is only a channel to reach support; the recovery itself still requires Data Protection verification.

No portal or configuration change (such as resetting MFA or adding another admin) is possible until Data Protection support verifies ownership and resets the Global Admin’s MFA or grants a new admin account.

References: