Sole Global Admin locked out by MFA (Authenticator lost) - need tenant admin MFA reset / Data Protection

Question

I am the only Global Administrator of a paid Microsoft 365 Business Premium tenant and I am completely locked out.

Situation:

• I can sign in with the correct password, but I am stopped at MFA.
• • The only configured method is Microsoft Authenticator, which is permanently lost (device gone, no cloud backup).
  • • "Sign in another way" offers only Authenticator options - no SMS, no phone call, no alternate email were ever configured.
    • • There are no other admin accounts in the tenant, so no one can reset MFA from the portal.
      • • Self-service password reset does not help, because the block is MFA, not the password.
      • What I need:
      • • A service request routed to the Data Protection / Tenant Recovery team to perform a tenant admin MFA reset after verifying ownership.
      • Ownership verification:
      • • I control the public DNS for the tenant's custom domain, so I can add any TXT record you require to prove ownership.
        • • I can also provide full billing/subscription details privately (invoice number, order ID, payment method last 4 digits, registered company name/address/VAT). I'd prefer not to post those in a public thread.
        • I've already tried phone support; the consumer queue cannot transfer me to business, and the online "Contact us" flow requires signing in to the tenant I'm locked out of. Please advise the correct path or initiate the Data Protection process. Thank you.

Answer 1

Hi Rafał Wójcik

Thank you for reaching out to the Microsoft Q&A Forum and sharing your issue. 

According to your situation, since you are the only Global Administrator and you are completely locked out from the tenant. So, only Microsoft Support team can help you in this MFA issue. You might need to contact us via phone service number: Customer service phone numbers - Microsoft Support. The agent will be able to create a ticket for you under the affected tenant and then transfer this ticket to Data Protection team who could help you to regain access.  

When a call is made to support, the first step is to provide an automated voice response from AI. Be careful, you won't be able to speak to a support representative if you don't respond appropriately here. 

Here's an example of a response that actually led to a support representative. Please refer to it:

Q. Can you tell me if you are calling as a home user who uses a product or service at home or a business user who uses it in your business to provide the best assistance? 
A.I am a business user. 
Q. Thank you. Can you give me the details of your inquiry? 
A. Login technical support. 
Q. First of all, can you tell me which products you are inquiring about today? 
A. Microsoft 365 business Standard。 
Q. Please wait a moment, I understand Microsoft 365. Are you calling about a new case or an existing one? 
A. New. 
Q. To receive phone support, your phone number must be associated with your Microsoft 365 admin profile. To do this, go to aka.ms/m365profile. Again, it aka.ms/m365profile . This can take 48 hours. In the meantime, you can go to aka.ms/m365profile and file a case online. If you prefer, you can also text the link to the phone number you are calling. What do you think? 
A. The phone number is already linked to the link. 
Q. Can you tell me about the products in your inquiry? 
A. Microsoft 365 Business Standard. 
Q. Are you a Global Administrator? 
A. That's right. 
Q. I'm sorry. I didn't understand. Are you a global administrator for your domain? 
A. Yes, I am a global administrator for the domain. 
Q. If you have any inquiries, you can contact a Microsoft representative. Are you sure? 
A. Yes. Please. 
Q. Yes, I understand. Please wait a moment.

Please note that this team is always overwhelmed, so you might need to wait for them to call you, this should take 3-10 working days. I know that this is not a convenient solution to hear but it seems to be the only way, and it's recommended that you should have a secondary/backup Global Administrator to fix this issue on your own.    

In case the phone line is not supportive, you can consider directly submitting a support request as a helpful workaround:    

-Create a temporary Microsoft 365 tenant using a trial license: Go to Microsoft 365 Business Plans and Pricing and click Try for free to set up a temporary Microsoft 365 tenant with a trial license.    

-Use this new account to sign in to the Microsoft 365 Admin Center and submit a support request on behalf of your primary (locked) account.   

-Click Help & Support > then choose Create a support request.    

Note: This method doesn't require you to use your new account for your business. Instead, it allows you to create a temporary global administrator account so you can submit a support request, as your original global administrator account is locked out due to issues with multi-factor authentication. The trial account is free for one month. Be sure to delete it after submitting your support request to avoid any automatic renewals or charges from Microsoft.     

For further instructions, you can follow this guide: Get support - Microsoft 365 admin | Microsoft Learn.   

I appreciate your understanding and patience in this matter. While I truly want to assist you, this issue is beyond the scope of my role as a forum moderator. I do not have access to internal databases or the ability to escalate cases directly to Microsoft’s internal teams. Therefore, please kindly contact the Microsoft Support team for the most efficient help.   

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

The situation matches a tenant lockout where the sole Global Administrator is blocked by MFA and no other admin can reset it. In this case, only Microsoft’s Data Protection / Tenant Recovery process can restore access.

Use these steps to get to the correct team:

1. Call Microsoft support by phone
   • Use the regional phone numbers listed at Customer service phone numbers - Microsoft Support (linked from the context below).
   • When the IVR asks about the problem, clearly state keywords like: “Authenticator”, “Office 365 for business”, “company account”, “administrator”, and “no other administrator”.
   • The goal is to reach an agent who can open a ticket with the Microsoft 365 Data Protection team (sometimes called Data Protection / Tenant Recovery) on behalf of the locked tenant.
2. What to say to the agent
   • State that this is a tenant lockout: you are the only Global Administrator, MFA is enforced, and the only method (Microsoft Authenticator) is lost.
   • Emphasize that you cannot sign in to the tenant to open a support request and that you need a Data Protection / Tenant Recovery case to reset the admin’s MFA methods.
   • Be prepared to provide:
     • Admin UPN for the locked tenant.
     • Tenant domain(s) (including the custom domain).
     • Confirmation that there are no other global admins.
     • Willingness to prove domain control (for example, adding a TXT record) and provide billing details privately.
3. If phone support is hard to reach or misroutes
   • As described in similar resolved cases, insist on speaking to a live agent and ask for escalation to a duty manager if the front-line cannot route to Data Protection.
   • If still blocked, one documented workaround is:
     1. Create a new trial Microsoft 365 tenant (separate from the locked one).
     2. Sign in to the admin center of the new tenant.
     3. Use Support → Help & support to open a ticket.
     4. In the ticket, clearly state that the issue is with a different existing tenant where you are the sole Global Admin and are locked out by MFA, and request connection to the Data Protection team for that original tenant.
4. What the Data Protection team does
   • Data Protection has internal tools and procedures to:
     • Verify that you are the legitimate administrator (using domain control, billing/subscription details, company information, etc.).
     • Reset or clear MFA for the admin account or otherwise restore an admin path into the tenant.
   • This process can take multiple days and may involve several verification steps, but it is the supported path when the only Global Admin is locked out and no other admin can reset MFA.
5. For future prevention (once access is restored)
   • Add at least one more Global Administrator and/or a Privileged Authentication Administrator so another account can reset passwords and MFA if this happens again.
   • Configure multiple MFA methods (Authenticator, phone, SMS, etc.) and create break-glass/emergency accounts excluded from Conditional Access, as recommended in the tenant lockout prevention guidance.

---

References:

• Troubleshoot sign-in issues and account access problems
• Preventing tenant lockouts
• About administrator roles in the Microsoft 365 admin center
• Common problems with two-step verification for a work or school account
• Can't use Azure Multi-Factor Authentication to sign in to cloud services after you lose your phone or the phone number changes
• You don't receive a text or voice call that contains the verification code for Microsoft Entra multifactor authentication
• Global Admin Locked out - Microsoft Q&A
• Requesting a Tenant Admin MFA Reset - Microsoft Q&A
• Severity A Situation - Locked out of global admin account (MFA) - business down - Microsoft Q&A
• I have a Micrsoft business account and I am the admin and the only user registered under this account. I can't log in because i have replaced my phone and the authenticator doesn't work. - Microsoft Q&A
• How Do I Regain Access to My Account After Losing Access to Microsoft Authenticator? (Urgent Request). - Microsoft Q&A
• Mandatory multifactor authentication for Azure and admin portals