Locked out of Microsoft 365 global admin due to lost mfs device

Question

I am locked out of Microsoft business 365 do to a lost Microsoft Authenticator phone. I use this email to run my business and am locked out on all devices .

details/

domain: palmlanepoperties.com

microsoft business 365 standard

no alternate mfs methods exist

password is correct (mandatory authentication)

global admin account inaccessible

unable to use supports because all portals require authentication

phone sports repeatedly hangs up after routing

I can verify domain ownership

billing info

tenant id

subscription ownership

I am looking for the correct escalation path for global admin tenant recovery

Answer 1

Dear @Michael Carino

Based on your description, I understand how urgent this situation must feel, especially since you’re the administrator and need to manage your subscription. Please know you’re not alone in this, and I’ll guide you through every step to get you back in control as quickly as possible.

Option 1: Contact Microsoft Data Protection Support by Phone (Primary Method)  

Since you are the administrator and are locked out, I recommend you try calling Microsoft's support line again to raise a request for resetting your authentication method. For a full list of regional numbers, you can also visit this official page: Customer service phone numbers - Microsoft Support. The support team will assist you as soon as possible. For reference:  Get support | Microsoft Docs   

Here are some tips and an example of a prompt to help you navigate the IVR more effectively: 

In some countries, it is an automated conversation like: First, when you call the hotline, it will be asked as follows: 

IVR: What kind of problem are you concerned about? 

You: Authenticator. 

IVR: What kind of product do you use? 

You: Office 365 for business. 

IVR confirmation: education or company account? 

You: For companies 

IVR: Are you an administrator? 

You: Yes. 

IVR: Do you have the other administrator in your organization? 

You: No. 

IVR: Do you need a... Service request? 

You: Yes  

This process should connect you with a live agent who will create a service request with the Data Protection team. They will then contact you to help you regain access. 

Option 2: Create a Temporary Account (Trial Tenant) to Submit a Support Ticket (Alternative Method) 

If you have difficulty reaching an agent by phone, there is a reliable workaround. This involves creating a new, temporary Microsoft 365 account to contact the support team online. 

Step 1: Sign up for a new Microsoft 365 Business trial using this link: Compare All Microsoft 365 Plans. You will need to use a different, personal email address to register. 

Step 2: Once the trial account is created, log in to its Admin Center > From the Admin Center, open a new Service Request. For reference:  Get support | Microsoft Docs   

Step 3: In the ticket description, explain that you are locked out of your primary tenant (your.onmicrosoft.com) and that you need to speak with the Data Protection team to regain access.

Step 4: Remember to provide your locked account's details and a good contact number for them to reach you. 

Important: Please remember to cancel the trial subscription after your original account issue is resolved to avoid any future charges. 

I am confident that the Data Protection team can resolve this for you. Please try the phone option first, as it is the most direct path. Let me know if you have any questions about these steps. 

Note: Please understand that as a forum moderator, my role is to provide general guidance and troubleshooting support. I don’t have access to internal systems or backend tools, and I appreciate your understanding of these limits.

I hope the information shared helps point you in the right direction. Thank you for your patience and understanding. I'm looking forward for your reply.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

For a locked-out sole global admin with only Microsoft Authenticator configured, the recovery path is through Microsoft’s Data Protection/Tenant Recovery process. The steps below align with that process.

1. Confirm there is no other global admin
   • If there is any other global admin in the tenant, that person can unlock the account by forcing MFA re-registration:
     • Sign in to Azure portal → Microsoft Entra ID → Users → select the locked-out account → Authentication methods → Require re-register multifactor authentication.
     • Then sign in again and register new MFA methods.
2. If you are the only global admin (your case) Use Microsoft’s Data Protection team to recover the tenant. There are two practical ways to reach them: Option A – Call Microsoft Global Customer Service (preferred)
   • Call the regional number listed under Customer service phone numbers - Microsoft Support.
   • When interacting with the IVR/agent, clearly state:
     • The issue is Authenticator / MFA lockout.
     • The product is Office 365 / Microsoft 365 for business.
     • It is a company (work) account, not personal.
     • You are the only global administrator.
     • You need a Data Protection / Tenant Recovery case to reset admin MFA.
   • Example flow (from the documented IVR script):
     • Problem: “Authenticator.”
     • Product: “Office 365 for business.”
     • Account type: “For companies.”
     • Are you an administrator?: “Yes.”
     • Any other administrators?: “No.”
     • Need a service request?: “Yes – I need the Data Protection Team.”
   • Be prepared to provide:
     • Domain (palmlanepoperties.com)
     • Tenant ID
     • Subscription details (Microsoft 365 Business Standard)
     • Billing/ownership proof
   Option B – Create a temporary trial tenant to open a ticket Use this only if phone support keeps disconnecting or cannot route correctly.
   • Sign up for a new Microsoft 365 trial tenant (a completely separate tenant).
   • In that new tenant, go to the Microsoft 365 admin center → Support → Help & support.
   • Open a support ticket explicitly stating:
     • You are locked out of a different, existing tenant where you are the sole global admin.
     • Provide:
       • Locked tenant’s admin UPN
       • Locked tenant’s domain (palmlanepoperties.com)
       • Tenant ID
       • Subscription type (Business Standard)
       • Error/behavior (MFA prompt to Authenticator only, device lost, no alternate methods)
       • Confirmation that you are the only global admin
     • Request escalation to the Microsoft Data Protection team for tenant admin MFA reset.
   • After recovery, cancel the trial subscription in the temporary tenant to avoid charges.
3. What the Data Protection team does
   • They use internal verification processes (domain, billing, tenant info) to confirm ownership.
   • Once verified, they can reset the global admin’s MFA registration so new methods can be configured at next sign-in.
4. Going forward
   • After access is restored, add multiple MFA methods (Authenticator on more than one device, phone, etc.).
   • Consider adding at least one additional admin or a Privileged Authentication Administrator so a single lockout does not block the entire tenant.

---

References:

• Can't use Azure Multi-Factor Authentication to sign in to cloud services after you lose your phone or the phone number changes
• You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
• Common problems with two-step verification for a work or school account
• Use a screen reader to set up and troubleshoot multifactor authentication
• Troubleshoot sign-in issues and account access problems
• About administrator roles in the Microsoft 365 admin center
• Global Admin Locked out - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A
• Mandatory multifactor authentication for Azure and admin portals