Sole Global Administrator locked out by MFA (Authenticator on lost device) with Security Defaults enabled — how do I regain portal access?

Question

I'm the only Global Administrator on an Entra ID tenant tied to a personal Microsoft account (pay-as-you-go subscription). I'm completely locked out of the Azure/Entra portal and need help recovering access.

Situation:

• Signing in at portal.azure.com reaches the "Approve sign-in request" MFA screen (Microsoft Authenticator, number-match).
• The Authenticator was registered on a device I no longer have, so I can't approve.
• Security Defaults is enabled on the tenant, which enforces this MFA.
• I'm the sole Global Admin — there's no other admin who can reset my MFA.

What already works:

• Azure CLI (az login) works fine — I'm authenticated to ARM and can list resource groups. So my credentials/password are valid; only the interactive portal MFA blocks me.

What I've tried:

• Turned off 2FA on the personal Microsoft account at account.microsoft.com — no effect on the tenant.
• Attempted to disable Security Defaults via Microsoft Graph (PATCH /policies/identitySecurityDefaultsEnforcementPolicy) using a delegated device-code token. The token does contain the Policy.ReadWrite.SecurityDefaults scope (verified by decoding the JWT scp claim), but Graph still returns 403 AccessDenied – "required scopes are missing in the token." I believe this write requires an MFA-satisfied token, which I can't get — a chicken-and-egg deadlock.
• On the MFA screen I do not see a usable "sign in another way" / alternate method.

Questions:

1. Is there a supported self-service path to reset/remove my own MFA methods as the sole Global Admin without another admin?
2. Why does PATCH identitySecurityDefaultsEnforcementPolicy return 403 "scopes missing" even when the delegated token clearly contains Policy.ReadWrite.SecurityDefaults — is an MFA/authentication-context claim actually required?
3. What is the correct Microsoft support channel for a sole-admin MFA lockout when I can't reach the portal to open a support request? (Billing/subscription support link, unauthenticated form, etc.)

Environment: Entra ID tenant (personal MSA owner), Security Defaults = ON, Windows + PowerShell, Microsoft Graph PowerShell SDK.I'm the only Global Administrator on an Entra ID tenant tied to a personal Microsoft account (pay-as-you-go subscription). I'm completely locked out of the Azure/Entra portal and need help recovering access.

Answer 1

Dear @Chhandak Dey,

I understand how frustrating it is to be locked out of your own tenant due to a lost MFA device, especially when you are the sole Global Administrator. Let’s address your specific questions and get this resolved.

Question 1: Can you bypass or reset MFA via Self-Service?

• No. Because Security Defaults is enabled and you are the sole Global Administrator; there is no self-service path or backdoor to reset your own MFA from the outside. Security Defaults strictly enforces MFA for all administrators, and without a second admin or a pre-registered backup method (like a phone number or FIDO2 key), you cannot bypass this screen on your own.

Question 2: Why did the Microsoft Graph PATCH request return a 403 error?

• Your analysis is entirely correct it is a classic "chicken-and-egg" deadlock. Even though your delegated token contains the Policy.ReadWrite.SecurityDefaults scope, Microsoft Graph enforces an Authentication Strength requirement for sensitive directory changes. Modifying security policies requires a token that has been elevated by an MFA claim (amr: mfa). Because your Azure CLI/device-code login bypassed the interactive MFA requirement, your token lacks the necessary authentication context, resulting in the 403 AccessDenied error.

Since you cannot open a support ticket from within the portal, you must contact the Microsoft Data Protection Team via phone. This is the only team authorized to manually reset MFA methods for sole Global Administrators after a strict identity verification process.

Find your local support number: Go to the official Microsoft documentation: Contact Microsoft customer support | Microsoft Support

Here are some tips and an example of a prompt to help you navigate the IVR more effectively:   

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)     

In some regions, the initial interaction may be automated, so here’s a general idea of how the conversation might go to help you prepare:       

What kind of problem are you experiencing?          

Answer: Authenticator          

What products do you use?          

Answer: Office 365 for business          

Is this for an education or company account?          

Answer: For companies          

Are you an administrator?          

Answer: Yes          

Are there any other administrators in your organization?          

Answer: No. I am the only admin in my tenant           

Do you need a... Service request?           

Answer: Yes. I need to create a ticket. Please send me direct to the Data Protection Teams.       

During the phone call, you will need to provide the information associated with your subscription, such as your company name, billing details, phone number, and an alternate email address, etc. This information allows the Data Protection team to verify your identity and securely assist you in regaining access to your administrator account.     

If calling phone support hasn’t been effective and you’re getting disconnected, there is another option you can consider as a workaround to reach the right team. You can sign up for a new Microsoft 365 tenant by creating a trial subscription here: Microsoft 365 Business Plans and Pricing | Microsoft 365  

Once that new tenant is created, you’ll be able to access the Microsoft 365 admin center and submit a support ticket directly from there. In the ticket, explain that you’re requesting assistance from the Data Protection Team for your original tenant, due to being locked out as the only admin with MFA issues. This method often helps bypass the automated loops because you’re able to submit the request from an authenticated admin center, even if it’s under a temporary tenant.

Note: Please remember to cancel the trial subscription once your issue is resolved to avoid any unintended charges.

Also, just to set expectations clearly and transparently, this is a user‑to‑user support forum, so I don’t have the ability to intervene directly or unlock accounts. I can only suggest additional options based on my experience and what has worked for others in the community.

I hope this information helps you take the right steps to regain access to your account. If you have any updates or additional details, please feel free to leave a comment under this post. I’ll be happy to assist further within my scope.