Microsoft 365 Admin Account Lost Authenticator Access - How to Recover?

Question

We have a Microsoft 365 business admin account that is no longer able to complete MFA authentication.

The Microsoft Authenticator app was previously configured on a mobile device, but the app data has since been cleared and the account is no longer available in Authenticator.

We have already tried resetting the account password, however sign-in still requires Microsoft Authenticator approval.

There is currently no access to the registered Authenticator device, and we are unable to sign in to the admin account.

What recovery options are available in this scenario?

• Can Microsoft remove or reset the MFA registration?
• Is there any self-service recovery method?
• If there are no other Global Administrators available, what is the recommended recovery process?

Any guidance would be greatly appreciated.

Moderator's note: Moved from Microsoft Security | Microsoft Authenticator

Answer 1

Hi Lim Kai Zhi

According to your situation, since the only Global Administrator is completely locked out from the tenant. So, only Microsoft Support team can help you in this MFA issue. You might need to contact them via phone service number: Customer service phone numbers - Microsoft Support. The agent will be able to create a ticket for you under the affected tenant and then transfer this ticket to Data Protection team who could help you to regain access.  

When a call is made to support, the first step is to provide an automated voice response from AI. Be careful, you won't be able to speak to a support representative if you don't respond appropriately here. 

Here's an example of a response that actually led to a support representative. Please refer to it:

Q. Can you tell me if you are calling as a home user who uses a product or service at home or a business user who uses it in your business to provide the best assistance? 
A.I am a business user. 
Q. Thank you. Can you give me the details of your inquiry? 
A. Login technical support. 
Q. First of all, can you tell me which products you are inquiring about today? 
A. Microsoft 365 business Standard。 
Q. Please wait a moment, I understand Microsoft 365. Are you calling about a new case or an existing one? 
A. New. 
Q. To receive phone support, your phone number must be associated with your Microsoft 365 admin profile. To do this, go to aka.ms/m365profile. Again, it aka.ms/m365profile . This can take 48 hours. In the meantime, you can go to aka.ms/m365profile and file a case online. If you prefer, you can also text the link to the phone number you are calling. What do you think? 
A. The phone number is already linked to the link. 
Q. Can you tell me about the products in your inquiry? 
A. Microsoft 365 Business Standard. 
Q. Are you a Global Administrator? 
A. That's right. 
Q. I'm sorry. I didn't understand. Are you a global administrator for your domain? 
A. Yes, I am a global administrator for the domain. 
Q. If you have any inquiries, you can contact a Microsoft representative. Are you sure? 
A. Yes. Please. 
Q. Yes, I understand. Please wait a moment.

Please note that this team is always overwhelmed, so you might need to wait for them to call you, this should take 3-10 working days. I know that this is not a convenient solution to hear but it seems to be the only way, and it's recommended that you should have a secondary/backup Global Administrator to fix this issue on your own.    

In case the phone line is not supportive, you can consider directly submitting a support request as a helpful workaround:    

-Create a temporary Microsoft 365 tenant using a trial license: Go to Microsoft 365 Business Plans and Pricing and click Try for free to set up a temporary Microsoft 365 tenant with a trial license.    

-Use this new account to sign in to the Microsoft 365 Admin Center and submit a support request on behalf of your primary (locked) account.   

-Click Help & Support > then choose Create a support request.    

Note: This method doesn't require you to use your new account for your business. Instead, it allows you to create a temporary global administrator account so you can submit a support request, as your original global administrator account is locked out due to issues with multi-factor authentication. The trial account is free for one month. Be sure to delete it after submitting your support request to avoid any automatic renewals or charges from Microsoft.     

For further instructions, you can follow this guide: Get support - Microsoft 365 admin | Microsoft Learn.   

I appreciate your understanding and patience in this matter. While I truly want to assist you, this issue is beyond the scope of my role as a forum moderator. I do not have access to internal databases or the ability to escalate cases directly to Microsoft’s internal teams. Therefore, please kindly contact the Microsoft Support team for the most efficient help.   

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".     

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

Answer 2

In this scenario, recovery options depend on whether there is another Global Administrator in the tenant.

1. If another Global Administrator exists

Another Global Admin can reset the affected admin’s MFA so it can be re-registered:

1. The other Global Admin signs in to the Microsoft Entra admin center (Azure portal).
2. Go to Users → All users.
3. Select the locked-out admin account.
4. Open Authentication methods.
5. Select Require re-register multifactor authentication.

At the next sign-in, the locked-out admin will be prompted to set up MFA again (for example, reconfigure Microsoft Authenticator) instead of being asked for the old, unavailable Authenticator approval.

This is the standard, supported way to clear and re-register MFA for a user when an admin is available.

2. If there is no other Global Administrator

If the locked-out account is the only Global Administrator, self-service recovery is not available. Forum moderators and normal support channels cannot directly change MFA for tenant admins; this must go through Microsoft’s Data Protection / Tenant Recovery process.

The recommended process is:

Option A – Call Microsoft Support and request Data Protection team involvement

1. Call Microsoft global customer service using the appropriate regional number from Customer service phone numbers - Microsoft Support.
2. When navigating the IVR, clearly indicate:
   • The issue is with Microsoft Authenticator / MFA.
   • The product is Office 365 / Microsoft 365 for business.
   • It is a company (not education, not personal) account.
   • The caller is the only Global Administrator and is locked out due to MFA.
   • A service request is needed and must be escalated to the Data Protection team to reset the admin’s MFA registration.
3. The Data Protection team will follow identity-verification procedures (for example, tenant ownership checks) and, once satisfied, can reset MFA registration for the admin so that new methods (including a fresh Authenticator registration) can be configured.

Option B – Create a temporary trial tenant to open a support ticket

If reaching a live agent by phone is difficult, a workaround is to:

1. Sign up for a new Microsoft 365 trial tenant (separate from the locked tenant).
2. In the new tenant, go to the Microsoft 365 admin center → Support → Help & support.
3. Open a support ticket explaining that:
   • The issue is with a different, existing tenant.
   • The admin for that tenant is locked out due to Microsoft Authenticator MFA.
   • There are no other Global Admins.
4. Ask for the case to be escalated to the Data Protection team for the original tenant so they can verify identity and reset MFA for the locked-out admin.

This trial tenant does not give access to the original tenant’s data; it is only a channel to reach Microsoft support.

3. Self-service recovery options

For a business / work account where Microsoft Authenticator is the only registered MFA method and the device/app is lost or wiped, there is no self-service way for the admin to remove or reset MFA. Recovery requires either:

• Another Global Admin to reset MFA as described above, or
• Microsoft Support (Data Protection team) to verify identity and reset MFA for the sole Global Admin.

4. Summary of answers to specific questions

• Can Microsoft remove or reset the MFA registration?
  Yes. The Microsoft Data Protection / Tenant Recovery team can reset MFA registration for a Global Admin after verifying identity and tenant ownership, typically initiated via a support call or ticket.
• Is there any self-service recovery method?
  No self-service recovery exists when Microsoft Authenticator is the only MFA method and it is no longer accessible. Admin intervention (another Global Admin) or Microsoft Support is required.
• If there are no other Global Administrators, what is the recommended recovery process?
  Contact Microsoft Support via the global customer service phone numbers, clearly state that this is a tenant admin lockout with no other Global Admins, and request escalation to the Data Protection team. If direct phone escalation fails, create a new trial tenant and use its admin center to open a support ticket requesting Data Protection assistance for the original tenant.

---

References:

• Recover user authentication methods using Microsoft Entra Backup and Recovery (Preview)
• Account recovery overview
• Common problems with two-step verification for a work or school account
• Global Admin Locked out - Microsoft Q&A
• How Do I Regain Access to My Account After Losing Access to Microsoft Authenticator? (Urgent Request). - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• Restore account credentials from Microsoft Authenticator
• How to go passwordless with your Microsoft account
• Use a screen reader to set up and troubleshoot multifactor authentication