Not Receiving Authentication Codes When Switching Directories

Question

I recently switched to a new phone but, unfortunately, did not have backups for the accounts from my previous device. While I have successfully set up my account on the Microsoft Authenticator app, I am encountering an issue where I am not receiving verification codes when switching between directories. As the sole Global Admin for the tenant, this situation is critical and qualifies as a tenant lockout scenario. Could you please assist me in resolving this issue?

Answer 1

Since this is a tenant lockout scenario and there is only one Global Admin, this must be handled by Microsoft support and the Data Protection team.

Use the following steps:

1. Confirm other verification options
   If any other MFA methods are configured (phone call, SMS, or another app), on the sign-in screen choose Other verification options and try those first. Also verify that the phone numbers in the user settings are correct, ideally by having another Global Admin check them. If there is no other admin, proceed to step 2.
2. Check for account blocking (if any other admin exists)
   If at any point another Global Admin is available, have them:
   • Go to the Azure portal → Microsoft Entra ID → Users → select the affected user.
   • Check whether Block sign in is enabled; if so, disable it and try again.
3. Treat as sole-admin tenant lockout
   Because there is only one Global Admin and that account is effectively locked out by MFA, this matches the documented tenant lockout pattern. In this case, recovery requires Microsoft’s Data Protection team:
   • Call Microsoft’s global customer service phone number for business support (see Customer service phone numbers - Microsoft Support in the referenced guidance).
   • In the IVR/with the agent, clearly state:
     • The issue is with Authenticator / MFA.
     • The product is Office 365 / Microsoft 365 for business (Entra ID tenant).
     • It is a company account, not personal.
     • Confirm being the only Global Administrator and that this is a tenant lockout.
     • Request a service request and escalation to the Data Protection team to restore access and reset MFA.
4. Alternative path if phone support is hard to reach
   If reaching a live agent is difficult, create a temporary trial tenant and open a support ticket from there:
   • Sign up for a Microsoft 365 trial to create a new tenant.
   • In the new tenant, go to the Microsoft 365 admin center → Support → Help & support.
   • Open a ticket explicitly stating that:
     • The problem is with a different, existing tenant.
     • Provide the locked tenant’s domain and Global Admin UPN.
     • Explain that this is a Global Admin MFA lockout and request to be connected to the Data Protection team.
   This temporary tenant is only for contacting support; it does not give access to data in the locked tenant.
5. Work with Data Protection team
   The Data Protection team will verify identity and administrative rights and then assist in resetting MFA or otherwise restoring access to the Global Admin account.

Until Microsoft completes this process, self-service recovery is not possible in a sole-admin tenant lockout scenario.

---

References:

• You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
• Frequently asked questions about Microsoft Entra multifactor authentication
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A

AI-generated content may be incorrect. Read our transparency notes for more information.