Locked Out

Question

I can’t log in to my admin account. My authenticator app is locked since it asks for a code I can’t generate. I need help verifying ownership and resetting MFA.

Answer 1

Hi Marco Carrasco, LLM, PMP

According to your situation, since you are the only Global Administrator and you are completely locked out from the tenant. So, only Microsoft Support team can help you in this MFA issue. You might need to contact Microsoft Support via phone service number: Customer service phone numbers - Microsoft Support. The agent will be able to create a ticket for you under the affected tenant and then transfer this ticket to Data Protection team who could help you to regain access.  

When a call is made to support, the first step is to provide an automated voice response from AI. Be careful, you won't be able to speak to a support representative if you don't respond appropriately here. 

Here's an example of a response that actually led to a support representative. Please refer to it:

Q. Can you tell me if you are calling as a home user who uses a product or service at home or a business user who uses it in your business to provide the best assistance? 
A.I am a business user. 
Q. Thank you. Can you give me the details of your inquiry? 
A. Login technical support. 
Q. First of all, can you tell me which products you are inquiring about today? 
A. Microsoft 365 business Standard。 
Q. Please wait a moment, I understand Microsoft 365. Are you calling about a new case or an existing one? 
A. New. 
Q. To receive phone support, your phone number must be associated with your Microsoft 365 admin profile. To do this, go to aka.ms/m365profile. Again, it aka.ms/m365profile . This can take 48 hours. In the meantime, you can go to aka.ms/m365profile and file a case online. If you prefer, you can also text the link to the phone number you are calling. What do you think? 
A. The phone number is already linked to the link. 
Q. Can you tell me about the products in your inquiry? 
A. Microsoft 365 Business Standard. 
Q. Are you a Global Administrator? 
A. That's right. 
Q. I'm sorry. I didn't understand. Are you a global administrator for your domain? 
A. Yes, I am a global administrator for the domain. 
Q. If you have any inquiries, you can contact a Microsoft representative. Are you sure? 
A. Yes. Please. 
Q. Yes, I understand. Please wait a moment.

Please note that this team is always overwhelmed, so you might need to wait for them to call you, this should take 3-10 working days. I know that this is not a convenient solution to hear but it seems to be the only way, and it's recommended that you should have a secondary/backup Global Administrator to fix this issue on your own.    

In case the phone line is not supportive, you can consider directly submitting a support request as a helpful workaround:  

-Create a temporary Microsoft 365 tenant using a trial license: Go to Microsoft 365 Business Plans and Pricing and click Try for free to set up a temporary Microsoft 365 tenant with a trial license.    

-Use this new account to sign in to the Microsoft 365 Admin Center and submit a support request on behalf of your primary (locked) account.   

-Click Help & Support > then choose Create a support request.    

Note: This method doesn't require you to use your new account for your business. Instead, it allows you to create a temporary global administrator account so you can submit a support request, as your original global administrator account is locked out due to issues with multi-factor authentication. The trial account is free for one month. Be sure to delete it after submitting your support request to avoid any automatic renewals or charges from Microsoft.     

For further instructions, you can follow this guide: Get support - Microsoft 365 admin | Microsoft Learn.   

I appreciate your understanding and patience in this matter. While I truly want to assist you, this issue is beyond the scope of my role as a forum moderator. I do not have access to internal databases or the ability to escalate cases directly to Microsoft’s internal teams. Therefore, please kindly contact the Microsoft Support team for the most efficient help.   

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".       

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.  

Answer 2

Follow these steps based on whether this is a work/school (Microsoft Entra / Microsoft 365) admin account and whether there are other admins.

1. If there is another global admin in the tenant

• Ask that admin to reset MFA so the authenticator can be set up again:
  1. Sign in to the Azure portal and open Microsoft Entra ID.
  2. Go to Users > select the locked-out admin account.
  3. Open Authentication methods.
  4. Select Require re-register multifactor authentication.
• After this, sign in again with the admin account. It will prompt to register MFA again (e.g., Microsoft Authenticator) and complete setup with a new device.

2. If there is no other global admin (only-admin locked out)

• This is a tenant lockout scenario. Only Microsoft’s Data Protection / Tenant Recovery process can restore access.
• Contact Microsoft Support using the appropriate customer service phone number from Customer service phone numbers - Microsoft Support.
• When prompted by the automated system, clearly indicate:
  • The issue is with Authenticator and Office 365 for business or Microsoft 365 for business.
  • It is a company or education account.
  • Confirm being an administrator and that there are no other admins.
  • Request a service request so the Data Protection team can verify identity and reset MFA registration.
• Be prepared to provide tenant and admin details (admin sign-in address, tenant domain, error messages, and proof of ownership) so Data Protection can verify ownership and reset MFA.

3. If this is a personal Microsoft account (not a work/school tenant)

• Use the standard account recovery and unlock flows:
  • If the account is locked or blocked, use the Sign-in Helper at Sign-in Helper or follow the guidance in When you can't sign in to your Microsoft account.
  • If MFA is blocking access, use any alternative verification method that was configured (SMS, email, etc.). If none work, follow the account recovery steps in the Microsoft account support articles.

4. If the authenticator app shows “Authentication did not complete” or similar

• Ensure Microsoft Authenticator is:
  • Unlocked on the device.
  • Allowed to send notifications (notifications not silenced).
  • Updated to the latest version.
  • On a device with correct date/time and working internet connection (try switching between Wi‑Fi and mobile data).

If SMS or voice MFA is also configured but not working, another global admin should verify that the phone numbers are correct in the user’s settings and that the account is not blocked from sign-in in Microsoft Entra ID.

---

References:

• Troubleshoot problems with Microsoft Authenticator
• You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
• Can't set up MFA because five devices are already registered to use an authenticator app
• Common problems with two-step verification for a work or school account
• Use a screen reader to set up and troubleshoot multifactor authentication
• Global Admin Locked out - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A
• Unblock my Outlook.com account
• Microsoft account has been locked
• Microsoft Curate - Troubleshoot Multi-Factor Authentication (MFA)