Full Azure tenant lockout

Question

I have a full Azure tenant lockout and can't open a support ticket. I'm the only global administrator on the tenant. Is there any way to get assistance? The issue is related to changing the global admin UPN and then it invalidating Microsoft Authenticator.

Answer 1

Hello Mike Fara,

Greetings! Thanks for raising this question in the Q&A forum.

The root cause of your lockout is well understood. When you change a Global Administrator's User Principal Name (UPN) in Microsoft Entra ID, the account registration in the Microsoft Authenticator app becomes invalid because the app stores the account identity using the original UPN. After the change, Authenticator no longer recognises the account correctly for push notifications and, in some configurations, for TOTP codes as well. This is a known and documented behaviour UPN changes require re-registration of MFA methods on the affected account.

There are several things to try before escalating to Microsoft Support, and I want to give you every self-service option first given your situation.

1. Try signing in with the new UPN and use the TOTP code from Authenticator. Even though push notifications will be broken, the time-based one-time passcode (TOTP) generated by Authenticator may still function because TOTP is derived from a shared secret seeded at registration time, not from the UPN itself. Open the Authenticator app, locate the account entry (it may still show the old UPN or email), tap on it, and note the six-digit rotating code. At the MFA prompt during sign-in with your new UPN, look for "Use a verification code" or "Enter a code from my authenticator app" and enter that code. This is the most likely self-service resolution for your specific scenario.
2. Try signing in with the old UPN if it still exists. If the old UPN was an alias or if you have not yet deleted the old username, try signing in at https://portal.azure.com using the previous UPN. In some configurations the old UPN remains valid as an alternate sign-in during a transition period, and Authenticator will still work with it since it was registered under that identity.
3. Try the SSPR portal for alternative verification methods. Navigate to https://aka.ms/sspr and attempt self-service account recovery. If a phone number (SMS) or backup email was registered on the account before the UPN change, you may be able to verify your identity through those methods and reset your MFA registration.
4. Try accessing the portal from a previously authenticated browser session. If you have any browser on any device where you were previously signed in and the session has not expired, that session may still be valid despite the UPN change and the MFA failure. Check all browsers and devices you use a persisted session could allow you to reach the portal and add a new MFA method or create a second admin account before the session expires.
5. Contact Microsoft Support by phone — this is the required escalation path. Since you cannot open a support ticket through the portal, contact Microsoft directly via phone. Go to https://support.microsoft.com/contactus, select Microsoft Azure or Microsoft Entra ID as the product, and choose phone support. No paid support plan is required for admin lockout cases. When connected, explain that you changed your Global Admin UPN which invalidated Authenticator, you are the only Global Admin, and you need MFA reset assistance to regain access. Provide your tenant ID or domain name, your new UPN, and any subscription or billing details that confirm your identity and ownership of the tenant.
6. Use the Microsoft 365 admin centre phone support entry point as an alternative. If your tenant has any Microsoft 365 subscription, navigate to https://admin.microsoft.com from any browser. The sign-in page sometimes exposes a "Contact support" or "Can't access your account?" path that does not require full MFA completion. This route also gives you access to phone support without a portal-based ticket.
7. Once you regain access, implement these safeguards immediately. Register at least two MFA methods on your admin account (Authenticator plus a phone number for SMS). Re-register Authenticator under your new UPN so the app has a current binding. Create a dedicated break-glass Global Administrator account that uses only a password, has no MFA requirement, is excluded from all Conditional Access policies, and whose credentials are stored securely offline. This prevents a single UPN change or device failure from causing a complete lockout in future.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix.