problema com o mfa

Question

Global administrator locked out due to MFA. No other global admin exists. Microsoft Authenticator was never configured. Need Tenant Recovery

Answer 1

I noticed that you’re using both Portuguese and English in your posts. Since this is an English forum, I’ll continue in English so my answer is as clear and helpful as possible. If you’d prefer me to switch to Portuguese, just let me know and I’ll gladly do so.

Hi @GRANDE ORIENTE DE MINAS GERAIS

Regarding your issue, if you are the only global administrator and is locked out, the next step would be to contact Microsoft Data Protection team directly for assistance as they have tools and processes in place to verify identity and regain access to administrator accounts.      

You can find the appropriate customer service phone numbers at this link: Customer service phone numbers.

Please remember to provide them with your account details and explain the situation. Be ready to provide:     

• The company name used during subscription    
• Billing email address (even if it’s a personal Microsoft account)    
• Payment method details (last 4 digits of the card, billing address)    
• Any subscription ID or invoice numbers from billing email    

When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.

To make the process smoother, here’s an example of how to respond when speaking to the automated system (IVR):     

IVR: What kind of problem are you concerned about?     

You:  Authenticator.    

IVR: What kind of product do you use?     

You: Office 365 for business.     

IVR: education or company account?     

You: For companies     

IVR: Are you an administrator?     

You: Yes.     

IVR: Do you have the other administrator in your organization?     

You: No.     

IVR: Do you need a... Service request?     

You: Yes     

These prompts help direct your call to the right support team more quickly, especially when dealing with account lockouts and authentication issues. 

If you still cannot reach to agent, there is still a workaround, you might consider registering for a new tenant by signing up for a trial subscription via this link Compare All Microsoft 365 Plans. This would allow you to create a new tenant following the provided prompts.    

• Follow the guided setup to create a new Microsoft account and a new tenant.
• This tenant will be completely separate from your existing Microsoft 365 environment.

Once set up, you can access the admin console of the new tenant by logging into admin center and follow the steps in this article: Get support - Microsoft 365 admin and submit a support ticket requesting to speak with the Data Protection team on behalf of your previous tenant.    

Include the following details:

• The administrator email address for the locked tenant
• The domain name of the locked tenant
• Any error messages you are seeing
• A description of the authentication or sign‑in issues
• Confirmation that you are the administrator of the locked tenant

Before submitting the ticket, make sure the Support Assistant is turned Off as several customers have reported that when the Support Assistant is enabled, the Contact Support option may not appear.

As shown in the screenshot, simply switch Support Assistant > Off, then enter your issue description. Once disabled, the Contact Support button should appear, allowing you to submit the ticket normally.

Important note:

• This new trial tenant does not provide access to any data, users, or settings from your original locked tenant. It is only intended as a temporary way to contact Microsoft Support.
• Once the issue with your original tenant is resolved, be sure to cancel the trial subscription to avoid any unintended charges. You can do this from the Microsoft 365 Admin Center by going to Billing > Your products and canceling the trial there.

Please remember to cancel the trial subscription once your issue is resolved to avoid any unintended charges.

As forum moderators, we don’t have access to the detailed system needed to troubleshoot this effectively due to privacy and security constraints. To quickly resolve this and regain access, the most effective step is to contact Microsoft Support Team directly. Only they have the ability to help with your Authenticator issue.    

Hopefully it will help work with your issue and if you have any other questions or need further assistance, feel free to ask.   

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Tenant recovery is required because the only global administrator is locked out by MFA and no other global admin exists.

Use these steps:

1. Confirm no alternative sign-in/MFA options
   • Try signing in at the admin portal with the known admin credentials.
   • If prompted for MFA, check whether any other verification options (SMS, voice call, passkey, or certificate-based authentication) are available. If none work and Microsoft Authenticator was never configured successfully, proceed to tenant recovery.
2. Use standard Microsoft 365 tenant recovery/support channels
   • Because there is no other global admin to reset MFA or password, recovery must go through Microsoft support and Data Protection / Tenant Recovery.
   • Go to the Microsoft 365 support page and choose the path for “I can’t sign in or access my tenant,” or use the global customer service phone numbers listed under Customer service phone numbers - Microsoft Support to reach a live agent.
   • Clearly state:
     • This is a Microsoft 365 for business tenant.
     • The only global administrator is locked out due to MFA.
     • Microsoft Authenticator was never configured (or cannot be used) and there are no other MFA methods.
     • There is no other global admin in the tenant.
   • Ask the agent to open a ticket with the Microsoft Data Protection / Tenant Recovery team to reset the admin’s MFA methods or restore access.
   • Be prepared to provide business documentation, domain ownership proof, and nonprofit registration data if applicable, as described in the tenant access recovery process.
3. If support portal sign-in is impossible
   • If sign-in is not possible anywhere to open a ticket, use phone support as the primary method.
   • As an alternative, some Q&A resolutions recommend creating a temporary trial Microsoft 365 tenant, then using that tenant’s admin center to open a support ticket on behalf of the locked tenant, explicitly requesting Data Protection / Tenant Recovery for the original tenant.
4. Understand what other channels cannot do
   • Microsoft for Nonprofits or forum moderators cannot bypass identity verification or directly grant access to the tenant. All ownership and access decisions are handled only through Microsoft 365 support and the Data Protection/Tenant Recovery process.
5. Prevent future lockouts after recovery
   • Once access is restored:
     • Add at least one additional global admin and/or a Privileged Authentication Administrator so that a future lockout can be resolved internally.
     • Configure multiple MFA methods (e.g., Authenticator, SMS, voice, passkey, or certificate-based authentication).
     • Create emergency “break-glass” accounts excluded from Conditional Access policies and document recovery procedures.

---

References:

• Tenant access recovery
• Preventing tenant lockouts
• Tenant Lockout: Scenarios & Next Steps
• Mandatory multifactor authentication for Azure and admin portals
• You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
• About administrator roles in the Microsoft 365 admin center
• Common problems with two-step verification for a work or school account
• "Activation failed" error when you try to set up Azure Multi-Factor Authentication
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• Global Admin Locked out - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• I need to reset my mfa methods - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A