Admin account locked out - no recovery options available

Question

I am the admin on Microsoft 365 tenant and have lost access to my Authenticator App. My username and password are correct, but the only MFA options presented are the Authenticator App or a code from the Authenticator App - no alternative methods exist on the account.

Account recovery via account.live.com/acsr does not recognize any of my email addresses. I have no backup codes. I cannot open a support ticket because I cannot sign in.

I need guidance on how to recover admin access to my tenant without an active authenticator, or how to reach Microsoft support without requiring an authenticated session.

Answer 1

Hi @Robert Gahnapetyan

Regarding your issue, as a forum moderator I want to help clarify a bit, the Microsoft account recovery form only works for personal Microsoft accounts (such as those ending in @hotmail.com, @outlook.com, etc.). It does not apply to work accounts. Since your account is a business account, that’s why the recovery form shows the message: “The Microsoft account entered does not exist.”

If you are the sole admin of your Microsoft 365 business tenant and is locked out, the next step would be to contact Microsoft Data Protection team directly for assistance as they have tools and processes in place to verify identity and regain access to administrator accounts.      

You can find the appropriate customer service phone numbers at this link: Customer service phone numbers.

Please remember to provide them with your account details and explain the situation. Be ready to provide:     

• The company name used during subscription    
• Billing email address (even if it’s a personal Microsoft account)    
• Payment method details (last 4 digits of the card, billing address)    
• Any subscription ID or invoice numbers from billing email    

When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.

To make the process smoother, here’s an example of how to respond when speaking to the automated system (IVR):     

IVR: What kind of problem are you concerned about?     

You:  Authenticator.    

IVR: What kind of product do you use?     

You: Office 365 for business.     

IVR: education or company account?     

You: For companies     

IVR: Are you an administrator?     

You: Yes.     

IVR: Do you have the other administrator in your organization?     

You: No.     

IVR: Do you need a... Service request?     

You: Yes     

These prompts help direct your call to the right support team more quickly, especially when dealing with account lockouts and authentication issues. 

As forum moderator, I don’t have access to the detailed system needed to troubleshoot this effectively due to privacy and security constraints. To quickly resolve this and regain access, the most effective step is to contact Microsoft Support Team directly. Only they have the ability to help with your Authenticator issue.    

Hopefully it will help work with your issue and if you have any other questions or need further assistance, feel free to ask.   

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Because there are no alternative MFA methods on the account and no backup codes, this is a full lockout scenario. The options depend on whether there is any other admin in the tenant.

1. If there is another Global Administrator
   • Ask that admin to sign in to the Azure portal → Microsoft Entra ID → Users → select the locked-out admin account → Authentication methods → Require re-register multifactor authentication.
   • After this, sign in again; the account will be prompted to set up MFA from scratch on the new device.
   • This is the standard and fastest way to recover access when at least one other global admin exists.
2. If there is no other Global Administrator (sole admin on the tenant)
   • This is a tenant lockout scenario where no one with sufficient rights can reset MFA.
   • In this case, recovery must go through Microsoft’s Data Protection / Tenant Recovery process; it cannot be done self-service.
   Use one of these paths to reach Microsoft support without signing in: Option A – Call Microsoft support (recommended)
   • Use the global customer service phone numbers listed under Customer service phone numbers - Microsoft Support in the documentation.
   • When navigating the automated system, clearly state:
     • The problem is with Authenticator.
     • The product is Office 365 for business / Microsoft 365 for business.
     • It is a company (work) account.
     • Confirm being an administrator and that there is no other administrator.
     • Request creation of a service request and escalation to the Data Protection team for tenant admin MFA reset / tenant recovery.
   • Be prepared to provide proof of identity and proof of ownership of the tenant (business details, domain, subscription info, etc.).
   Option B – Create a temporary trial tenant to open a ticket
   • If reaching a live agent by phone is not possible, create a new, separate Microsoft 365 trial tenant (as described in the Q&A guidance) just to gain access to an admin center.
   • Sign in to the new tenant’s Microsoft 365 admin center → Support → Help & support and open a support ticket.
   • In the ticket, clearly state that:
     • This new tenant is only for contacting support.
     • The real issue is being locked out of a different existing tenant where you are the only Global Administrator.
     • Include the locked tenant’s admin UPN, tenant domain, error messages, and that MFA is enforced with no available methods.
   • Ask support to route the case to the Data Protection team for admin MFA reset / tenant recovery.
3. Why self-service recovery is not working
   • The consumer account recovery form and tools (such as the Microsoft account recovery form and Sign-in Helper) apply to personal Microsoft accounts, not to work/school (Entra ID) tenants, which is why they do not recognize the admin addresses in this scenario.
   • For work/school tenants with a sole locked-out admin, Microsoft support and Data Protection are the only supported recovery paths.

Until Microsoft completes identity verification and resets MFA registration, there is no way to bypass or disable MFA on the tenant.

---

References:

• Common problems with two-step verification for a work or school account
• Troubleshoot Microsoft verification code issues
• Account recovery overview
• Preventing tenant lockouts
• Global Admin Locked out - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A