Locked Out of All Global Administrator Accounts Due to Microsoft Authenticator Loss. How to Recover Access?

Question

We are locked out of all Microsoft 365 Global Administrator accounts due to loss of access to Microsoft Authenticator. We still own and control the domain razrprints.com and have access to non-admin accounts, but no administrator account can complete MFA. We require tenant administrator recovery and MFA reset assistance.

I have called the microsoft support thrice and has all been disconnected without having the issue resolved. Its an AI assisted call and it disconnected me. Anybody here who can help me?

Answer 1

This situation is a tenant lockout where no Global Administrator can complete MFA and there are no other admins who can reset MFA. In this case, only Microsoft Support (Data Protection / Tenant Recovery team) can restore access.

Use the following supported paths and wording when contacting Microsoft:

1. Call Microsoft 365 business support by phone
   • Use the country/region phone number listed under Customer service phone numbers - Microsoft Support: see Find Microsoft 365 for business support phone numbers by country or region.
   • When navigating the IVR, clearly state:
     • Problem type: “Authenticator” or “Multi-factor authentication”.
     • Product: “Office 365 for business” / “Microsoft 365 for business”.
     • Account type: “Company account”.
     • Role: “I am the tenant Global Administrator”.
     • Other admins: “There are no other administrators; all admin accounts are locked out by MFA”.
     • Request: “I need to create a service request and be transferred to the Data Protection team for tenant admin MFA reset / tenant recovery.”
   • If the IVR tries to route away or disconnect, insist on: “I need a service request; please route me to an agent for Data Protection / Tenant Recovery; this is a tenant lockout and I am the only admin.”
2. If direct phone support keeps failing, create a temporary tenant to open a ticket
   • Sign up for a new Microsoft 365 trial tenant (any business/enterprise trial) as described in the Q&A guidance.
   • In the new tenant, go to Microsoft 365 admin center → Support → Help & support and open a ticket.
   • In the ticket, clearly state:
     • This new tenant is only for contacting support.
     • The locked tenant name and domain (for example, razrprints.com).
     • The admin UPN(s) that are locked out.
     • That all Global Administrators are locked out by MFA and no one can access the admin portal.
     • That you need the Data Protection team to perform tenant admin MFA reset / re-register MFA for at least one Global Administrator.
   • Be prepared to provide proof of domain and tenant ownership (business documentation, domain control, contact details) when the Data Protection engineer contacts you.
3. If your subscription was purchased via a partner/reseller
   • If a CSP or reseller manages the subscription, contact the partner and ask them to open a Microsoft support ticket on your behalf for tenant lockout / Data Protection MFA reset for the only Global Admin.
4. After recovery
   • Once access is restored, implement the recommended protections to avoid future lockouts:
     • Create at least two cloud-only emergency access (“break-glass”) accounts permanently assigned the Global Administrator role, used only for emergencies and excluded from Conditional Access and MFA policies, per Securing privileged access for hybrid and cloud deployments in Microsoft Entra ID and Add and manage admin accounts.
     • Require MFA for all other admin roles using Conditional Access, but exclude the emergency accounts from those policies, as recommended in Require MFA for administrators and Require multifactor authentication for admins accessing Microsoft admin portals.

Only Microsoft’s Data Protection / Tenant Recovery team can reset MFA when every Global Administrator is locked out. The practical next step is to get a live agent via the business support phone line or via a ticket from a new trial tenant or partner, and explicitly request escalation to the Data Protection team for tenant admin MFA reset.

---

References:

• Preventing tenant lockouts
• Add and manage admin accounts
• Require MFA for administrators
• About administrator roles in the Microsoft 365 admin center
• Require multifactor authentication for admins accessing Microsoft admin portals
• Apply Conditional Access policies to Private Access apps
• Apply Conditional Access policies to Global Secure Access traffic
• Securing privileged access for hybrid and cloud deployments in Microsoft Entra ID
• Global Admin Locked out - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• How Do I Regain Access to My Account After Losing Access to Microsoft Authenticator? (Urgent Request). - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A

Answer 2

Thank you to everyone who has taken the time to pitch in and help me with the issue.

I look forward to the day when AI-powered call centers can combine efficiency with geniune patience and empathy. If my call center call had been handled by a human agent, I believe they would have remained engaged throughout the process rather than terminating my call.

While I admit Im still more comfortable speaking with a person, Im not opposed to AI-powered support. There is so much potential and I am looking forward to the improvements on areas of patience, contextual understanding and the ability to persist through complex customer issues without prematurely ending the interaction.

I now have an SR opened and I am looking forward to its resolution.

Have a nice day to all of you.

Answer 3

Hi info

I understand how frustrating it must be when all Global Administrator accounts are inaccessible and you are completely locked out of the tenant. In this situation, only the Microsoft Support team can assist with this MFA-related issue.

If you are unable to reach the Microsoft Support team by phone, you can consider directly submitting a support request as a helpful workaround:     

-Create a temporary Microsoft 365 tenant using a trial license: Go to Microsoft 365 Business Plans and Pricing and click Try for free to set up a temporary Microsoft 365 tenant with a trial license.     

-Use this new account to sign in to the Microsoft 365 Admin Center and submit a support request on behalf of your primary (locked) account.    

-Click Help & Support > then choose Create a support request.     

Note: This method doesn't require you to use your new account for your business. Instead, it allows you to create a temporary global administrator account so you can submit a support request, as your original global administrator account is locked out due to issues with multi-factor authentication. The trial account is free for one month. Be sure to delete it after submitting your support request to avoid any automatic renewals or charges from Microsoft.      

For further instructions, you can follow this guide: Get support - Microsoft 365 admin | Microsoft Learn.    

Please note that this team is always overwhelmed, so you might need to wait for them to call you, this should take 3-10 working days. I know that this is not a convenient solution to hear but it seems to be the only way, and it's recommended that you should have a secondary/backup Global Administrator to fix this issue on your own.   

I appreciate your understanding and patience in this matter. While I truly want to assist you, this issue is beyond the scope of my role as a forum moderator. I do not have access to internal databases or the ability to escalate cases directly to Microsoft’s internal teams. Therefore, please kindly contact the Microsoft Support team for the most efficient help.    

I hope my information is helpful. Please give me any updates once you get this resolved. 

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.