Can’t using another method MFA

Question

I’m Global Administrator locked out of Microsoft 365 tenant. I Lost Microsoft Authenticator after changing phones. trying to another method using SMS have some Error Code: 399287

Trying to call customer support, can’t reach team support. until now i can’t access admin portal, my domain, and my office 365.

Need Data Protection / Tenant Recovery team to reset MFA/Security Info for administrator account.

Answer 1

Please understand that as forum moderators, we do not have the tools or sufficient access to make changes to user accounts, including logging in, resetting passwords, or modifying access rights. For your security, only Microsoft Support can assist with these requests. 

Hello @Sahrudin Sudi Saeraji,

Thank you for reaching out.

Could you please help me confirm whether there is another active Global Administrator in your organization? If there is, they can revoke and require re-registration of Multi-Factor Authentication (MFA) settings for your account by following these steps: 

• Signing in to the Microsoft Entra Admin Center
• Navigating to Users > Your Account > Authentication methods  
• Selecting Require re-register MFA  

Once this is completed, you will be prompted to set up MFA again during your next login 

If you are the only admin: 

You will need to contact Microsoft’s Data Protection team. This team has the authority and the specific security procedures to verify your identity as the legitimate owner of the account and then reset your MFA settings from their end. Please try to find the related hotline number to call the frontline and let them raise a ticket for you: Customer service phone numbers - Microsoft Support    

Here are some tips and an example of a prompt to help you navigate the IVR more effectively:  

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)    

In some regions, the initial interaction may be automated, so here’s a general idea of how the conversation might go to help you prepare:      

• What kind of problem are you experiencing?         
• Answer: Authenticator         
• What products do you use?         
• Answer: Office 365 for business         
• Is this for an education or company account?         
• Answer: For companies         
• Are you an administrator?         
• Answer: Yes         
• Are there any other administrators in your organization?         
• Answer: No. I am the only admin in my tenant          
• Do you need a... Service request?          
• Answer: Yes. I need to create a ticket. Please send me direct to the Data Protection Teams.      

During the phone call, you will need to provide the information associated with your subscription, such as your company name, billing details, phone number, and an alternate email address, etc. This information allows the Data Protection team to verify your identity and securely assist you in regaining access to your administrator account. 

---

If you are unable to reach support via the phone numbers, there is a workaround you might consider: You can register for a new Microsoft 365 tenant by signing up for a trial subscription here: Microsoft 365 Business Plans and Pricing | Microsoft 365    

Once the new tenant is created, you can access the admin center and submit a support ticket from there, requesting to speak with the Data Protection Team on behalf of your original tenant.    

Important notes:     

• This new trial tenant will not give you access to any of the data or settings in your original locked tenant. It is solely a temporary means to contact Microsoft support.    
• The resolution time might be longer as you are contacting support from a different tenant.    
• Remember to cancel the trial subscription for the new tenant once your issue with the original account is resolved to avoid any unintended charges.  

I hope the information provided helps guide you in the right direction. Although I’m unable to take direct action, I sincerely hope that the steps and recommendations I’ve shared can support you through the process.  

Warm regards, 

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Error code 399287 and the inability to use SMS or Microsoft Authenticator indicate that Microsoft Entra multifactor authentication has effectively locked the administrator account and no alternative verification methods are available.

Because the account is a Global Administrator and there is no access to the admin portal, recovery depends on whether there is another administrator in the tenant.

1. If there is another Global/Privileged admin in the tenant
   • That admin must sign in to the Azure portal and reset MFA for the locked-out admin:
     1. Go to the Microsoft Entra admin center (Azure portal → Microsoft Entra ID).
     2. Go to Users → All users and select the locked-out admin account.
     3. Open Authentication methods.
     4. Select Require re-register multifactor authentication and save.
   • After this, sign-in will prompt for MFA registration again and a new Microsoft Authenticator instance (or other methods) can be configured.
2. If there is no other admin (sole Global Administrator / tenant lockout)
   • This is a tenant lockout scenario where only Microsoft’s Data Protection / Tenant Recovery process can restore access.
   • Forum moderators and normal support channels cannot directly reset MFA or bypass verification; only the Data Protection team can, after verifying identity and tenant ownership.
   • To reach the Data Protection team when the admin portal is inaccessible:
     1. Call Microsoft’s global customer service and request a Data Protection / Tenant Recovery case for an admin locked out by MFA. Use the guidance from the Q&A answers when navigating the IVR, for example:
        • When asked for the problem: say “Authenticator”.
        • Product: “Office 365 for business”.
        • Account type: company account.
        • Are you an administrator?: Yes.
        • Any other administrators?: No.
        • Request: create a service request and route to the Data Protection team.
     2. If the frontline agent routes incorrectly (for example, to a consumer or non-admin queue), insist that this is a tenant lockout and that there is no other global admin and ask specifically for the Data Protection team.
3. If phone support cannot be reached or cannot create the case
   • As an alternative path used in similar cases:
     1. Create a new temporary Microsoft 365 tenant by starting a free trial subscription.
     2. Sign in to the new tenant’s Microsoft 365 admin center.
     3. Open Support → Help & support and create a support ticket.
     4. In the ticket, clearly state that:
        • This is a different tenant created only to contact support.
        • The problem is a Global Administrator locked out of the original tenant due to MFA, with no other admins.
        • Data Protection / Tenant Recovery assistance is required to reset MFA/security info for the original admin account.
     5. Provide the original tenant’s domain, the locked admin UPN, and all requested proof of ownership.
   • After recovery, cancel the trial subscription on the temporary tenant to avoid charges.

Until the Data Protection / Tenant Recovery team verifies identity and resets MFA/security info, access to the original tenant, domain, and Microsoft 365 services cannot be restored.

---

References:

• You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
• Authentication methods in Microsoft Entra ID - Voice call
• Common problems with two-step verification for a work or school account
• About administrator roles in the Microsoft 365 admin center
• Can't use Azure Multi-Factor Authentication to sign in to cloud services after you lose your phone or the phone number changes
• Global Admin Locked out - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• Microsoft authenticator sending me into a spiral - Microsoft Q&A
• Preventing tenant lockouts
• "Account verification system is having trouble" error message when you try to sign in by using a work or school account