I am locked out of my Microsoft 365 account due to MFA.

Question

Error code: AADSTS500121.

The Microsoft Authenticator app is my only authentication method and I no longer have access to it.

There are no alternative sign-in methods available.

I cannot self-service recover nor get through the support numbers to Microsoft’s Data Protection / Tenant Recovery team.

Answer 1

Hi @YH,

Thank you for taking the time to share your experience. I hope this response reaches you in time and helps bring some clarity.

The error you’re encountering (AADSTS500121) generally indicates that multi-factor authentication (MFA) is required for the account, but the authentication step may not be able to complete successfully. In this situation, it appears that the Microsoft Authenticator app is the only configured authentication method, and access to it is no longer available. In this situation, the multi‑factor authentication (MFA) settings need to be reset so the Microsoft Authenticator app can be re‑registered and access restored.

As a member of the community support team, I have limited access and cannot modify MFA settings for user accounts. For security reasons, the appropriate recovery options may differ based on your role in the organization.

---

• Option 1: Contact your IT administrator

If you are either an admin or end-user in your company, please check if there are other IT admins who still have access and share with them the steps outlined in the article Manage user authentication methods for Microsoft Entra multifactor authentication. This will help them assist you in resetting your MFA settings and restoring access to the account.

In case you do not know who is your IT admin, kindly refer to this article: How do I find my Microsoft 365 admin? - Microsoft Support .

Once your admin completes this process, your previous sign-in sessions will be cleared, and the next time you log in, you will be prompted to set up MFA again from scratch.

---

• Option 2: Contact Microsoft Data Protection Support by phone (Please proceed with the third option if contacting phone support is not applicable to the situation)

I understand that you’ve already attempted to reach support by phone without success. If you are the sole admin in your organization, you may consider contacting Global Customer Support again and following the script below to help navigate the automated phone system more effectively.

During the phone call, you will need to provide the information associated with your subscription, such as your company name, billing details, phone number, and an alternate email address, etc. This information allows the Data Protection team to verify your identity and securely assist you in regaining access to your administrator account.

Here are some tips and an example of a prompt to help you reach out the Microsoft Data Protection team support more effectively:

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)

In some countries, it is an automated conversation like:

IVR: What kind of problem are you concerned about?

You: Authenticator.

IVR: What kind of product do you use?

You: Office 365 for business.

IVR confirmation: education or company account?

You: For companies

IVR: Are you an administrator?

You: Yes.

IVR: Do you have another administrator in your organization?

You: No.

IVR: Do you need a... Service request?

You: Yes. I need to create a ticket. Please send me directly to the Data Protection Team.

Please note that forum moderators do not have access to user account settings and cannot assist with logging in, resetting passwords, or changing access rights. While we do not have access to internal systems or administrative tools required to resolve account-specific or backend-related issues, we’ll continue doing our best to support you within the scope of our responsibilities.

---

• Option 3: Create a new tenant to submit a support ticket (Alternative method)

Please note that the trial tenant is intended only to help you create a support ticket for your existing business tenant. It is not meant to replace or serve as your primary tenant.

If you still cannot reach a live agent, there is still a workaround, you might consider registering for a new tenant by signing up for a trial subscription.

To set up a new tenant, please follow these steps:

• Visit Microsoft 365 Business Plans and Pricing | Microsoft 365and select "Try for free". This would allow you to create a new tenant following the prompts provided. Once set up, you can access the admin console of the new tenant and submit a support ticket requesting to speak with the Data Protection team on behalf of your previous tenant.
• Create a support ticket: In the Microsoft 365 Admin Center > Help & Support.
• In your ticket description, you'll need to clearly explain that you're trying to regain access to your previous Microsoft 365 tenant and need help from the Data Protection team. Here's a message you can use or adapt:

"Hello, I’m currently unable to access my previous Microsoft 365 tenant due to losing MFA access. I’m the only global admin, but I’m locked out and unable to generate a QR code or bypass MFA.

I created this new tenant solely to request assistance. I kindly ask to be connected with the Data Protection team to verify my identity and help me recover access to the original tenant.

This is urgent, as I rely on Microsoft 365 for my work and have been unable to operate for several days. I’m available to provide any documentation or verification needed to support the recovery process."

• Please remember to cancel the trial subscription after your issue is resolved, as this will help you avoid any accidental billing. You may prefer the following resource for detailed instructions: Cancel your Microsoft business subscription in the Microsoft 365 admin center | Microsoft Learn.

I hope this helps you regain access to your account quickly. I'm glad to assist and truly hope the information provided has been useful. Please feel free to reach out anytime if you need further assistance.

If you find my post useful, kindly consider upvoting it. Doing so can assist others in the community who may have similar questions in finding solutions more quickly.

Thank you for your kindness and contributions to the forum.

---

If the answer is helpful, please click "Accept Answer". If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in this documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

The account is locked out by Microsoft Entra multifactor authentication because the only registered method (Microsoft Authenticator) is unavailable and there are no alternative sign-in methods.

Because self-service recovery and normal sign-in are blocked, resolution depends on whether there is another administrator in the tenant.

1. If there is another global administrator in the tenant
   • That admin must reset the MFA registration so the account can enroll a new Authenticator instance:
     1. Sign in to the Azure/Microsoft Entra admin portal.
     2. Go to Microsoft Entra ID → Users.
     3. Select the locked-out user account.
     4. Open Authentication methods.
     5. Select Require re-register multifactor authentication.
   • After this, the next sign-in for the locked-out account will prompt to set up MFA again (scan QR code in the new Authenticator app, etc.).
2. If there is no other global administrator (only one admin on the tenant)
   • This is a tenant lockout scenario. Only Microsoft’s Data Protection / Tenant Recovery process can restore access.
   • The documented path is to reach Microsoft’s Data Protection team via global support phone numbers and have a support ticket created for MFA reset / tenant recovery:
     • Call the appropriate number from Customer service phone numbers - Microsoft Support.
     • In the IVR or with the agent, clearly state:
       • The issue is with Authenticator / MFA for Office 365 for business.
       • It is a company (work) account, not education or personal.
       • The caller is the only global administrator and is locked out.
       • A service request is needed and must be routed to the Data Protection team (tenant recovery / admin MFA reset).
   • In some regions this is an automated conversation; the documented pattern is to answer along the lines of:
     • Problem: “Authenticator”
     • Product: “Office 365 for business”
     • Account type: “For companies”
     • Are you an administrator?: “Yes”
     • Any other admins?: “No”
     • Need a service request?: “Yes”
3. If phone support cannot be reached or will not route correctly
   • The documented workaround is to create a temporary trial tenant solely to open a support ticket:
     1. Sign up for a new Microsoft 365 trial tenant (separate from the locked tenant).
     2. In that new tenant, go to the Microsoft 365 Admin Center → Support → Help & support.
     3. Open a support request explicitly stating:
        • This is about a different, existing Microsoft 365 tenant.
        • The admin account on that tenant is locked out due to MFA (Authenticator only, device lost/unavailable).
        • There are no other global admins.
        • Request escalation to the Data Protection / Tenant Recovery team to verify ownership and reset MFA for the locked tenant.
     4. Be prepared to provide tenant domain, admin UPN, error details (including AADSTS500121), and business verification information.
     5. After resolution, cancel the trial subscription for the temporary tenant to avoid charges.
4. If this is a work or school account where an organization IT help desk exists
   • Contact the organization’s help desk or Microsoft 365 administrator and request an MFA reset as described above (Require re-register multifactor authentication). End users cannot bypass MFA themselves when Authenticator is the only method.

Until Microsoft or another global admin resets the MFA registration, sign-in will remain blocked when Authenticator is the only configured method and no alternative verification options exist.

---

References:

• Common problems with two-step verification for a work or school account
• Use a screen reader to set up and troubleshoot multifactor authentication
• Troubleshoot Microsoft verification code issues
• Microsoft account has been locked
• Global Admin Locked out - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A