Cannot complete MFA - Admin account locked

Question

Hello,

I recently changed my phone and no longer have access to Microsoft Authenticator.

I am the only Global Admin of my tenant and cannot complete MFA verification. All authentication methods require MFA, and my phone number also does not work.

I still have an active session in Power BI but cannot change authentication settings.

Please help reset MFA so I can register a new authenticator device.

Thank you.

Answer 1

Because all existing MFA methods are unavailable and there is only one Global Administrator, this is a tenant lockout scenario that cannot be fixed from the portals or Power BI alone.

Use the following recovery paths:

1. If there is actually another admin
   • Any Global or Authentication Administrator in the tenant can reset the locked-out admin’s MFA so new methods can be registered:
     1. Sign in to the Microsoft Entra admin center as an admin.
     2. Go to Entra ID → Users → select the locked-out admin account.
     3. Open Authentication methods.
     4. Select Require re-register MFA.
     5. Next time the locked-out admin signs in, they will be prompted to set up MFA again (new phone / new Authenticator app, new phone number, etc.).
2. If there is no other admin (only one Global Admin – your case)
   • This must be handled by Microsoft’s Data Protection / Tenant Recovery team via a support request. Forum moderators or normal users cannot reset MFA for an admin.
   • Contact Microsoft Support by phone using the “Customer service phone numbers - Microsoft Support” page referenced in the context. When connected to the IVR/agent, clearly state:
     • The issue is loss of access to Microsoft Authenticator and all MFA methods for the only Global Admin.
     • The tenant is a business/organization (work or school) account.
     • There is no other administrator who can reset MFA.
     • A Data Protection / Tenant Recovery case is needed to reset the admin’s MFA registration.
   • Be prepared to provide proof of identity and tenant ownership (business details, domain, billing info, etc.) as requested by the Data Protection team.
3. Alternative way to reach Data Protection if phone support is difficult
   • Create a temporary trial Microsoft 365 tenant, then use that tenant’s admin center to open a support ticket on behalf of the locked tenant, explicitly requesting Data Protection / tenant recovery for the original tenant and describing that the only Global Admin is locked out due to MFA.

Once Microsoft Support/Data Protection verifies ownership, they can clear the MFA methods on the admin account so that, on next sign-in, a fresh MFA registration (new Authenticator on the new phone, updated phone number, etc.) can be completed.

Active sessions in services like Power BI do not provide a supported path to bypass or change MFA; the reset must be done either by another admin via Require re-register MFA or by Microsoft Support/Data Protection.

---

References:

• Manage user authentication methods for Microsoft Entra multifactor authentication
• Can't use Azure Multi-Factor Authentication to sign in to cloud services after you lose your phone or the phone number changes
• You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
• Global Admin Locked out - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A