Sole global admin locked out: MFA setup prompt asks for an Authenticator code that was never set up, and the SMS fallback fails with Error Code 399287

Question

Hi all,

I've been asked to help out a client that locked herself out of her account. We're stuck in what really looks like a loop and I'd appreciate a pointer on where to take it. Posting from a personal account, since the tenant account is the one I can't get into.

Some background first. Nobody registered the Authenticator app, and nobody was ever asked for a second factor. That changed recently and the admin portals now insist on MFA.

This is what happens when I sign in from a device that hasn't been used with this account before:

1. Username and password are accepted, no problem.
2. I get a screen saying it's time to set up MFA with the Microsoft Authenticator app, asking whether I want to do that now.
3. I say yes. Instead of a QR code or any kind of enrollment step, I land on a screen headed "Enter code" that says "Enter the code displayed in the authenticator app on your mobile device."
4. There is no Authenticator app for this account, so there is no code to enter.
5. If I click "Having trouble? Sign in another way" I get three options: a verification code from the Authenticator app, text a code to a mobile number, or call to that same number.
6. Both phone options fail straight away with "Sorry, we're having trouble verifying your account. Please try again." and Error Code: 399287.

So it wants me to register a method, but won't let me register anything until I've proven myself with a method that doesn't exist, and the two phone methods that are on the account are blocked.

About that phone number. It goes back to the original tenant setup and belongs to an IT provider who hasn't been involved with this client for years. I've spoken to them: they still have the number and are willing to read me a code if one ever arrives. They have no delegated admin relationship with the tenant, so they can't reset anything themselves either. That was the first thing I checked.

From reading the other 399287 threads here, my understanding is that the number has picked up a bad reputation flag in the PhoneReputation service and is blocked for verification, and that it's not something I can clear from the account or the device. A number that a provider used across a lot of tenants collecting that flag would make sense to me, but I have no way to verify that.

A few other things I can confirm:

• Single global admin account, no other admin accounts in the tenant.
• I've tried both the text and the call option, several browsers, incognito windows, two devices and two different networks. Same error every time.
• The provider confirms the handset receives texts from other senders normally, so it isn't a delivery problem at the carrier.
• The same credentials sign in fine by password to Microsoft properties that don't sit behind the admin portal MFA requirement, so the password is definitely valid. It's the MFA step that fails.
• The tenant has a verified custom domain and I have admin access to its DNS, so I can prove domain ownership with a TXT record whenever that's needed.
• I've stopped retrying, since I assume each failed attempt only adds to whatever risk signal is on the number.
• Registered number is Dutch, country code +31.

My question: how do I get the PhoneReputation flag on this number looked at and removed, so the phone methods already on the account start working and I can get through the registration prompt? The password is fine and I can get a code read to me, so if the flag is lifted I can sign in without anything needing to be reset. First thing I'll do once I'm in is register the client's own Authenticator and phone number and delete the old provider number, which should have happened years ago.

I've left out the Request Id, Correlation Id, timestamp, UPN, tenant ID and phone number because of the PII guidance, but I have all of it and can send it by private message.

Thanks in advance for any help.

Answer 1

Hi Ryan,

Thank you very much for the detailed reply. The IVR walkthrough in particular was really useful to have in front of me before calling.

Unfortunately I haven't managed to get through yet. I've tried the hotline three times now. The first call disconnected shortly after a message saying it would like to help me. On the second attempt it offered to send me a link by text, but the message never arrived. On the calls after that it just repeats the link and then ends the call, so I haven't been able to reach anyone to ask for a ticket.

So I'm a bit stuck on how to actually reach the Data Protection Team. I completely understand that you can't make changes to the account yourself, and I'm not asking for that. I'm just hoping you might know of another way to get a case opened, or whether there's anything I can do differently on the phone to get past the automated system. Happy to try any of it.

Thanks again for your help so far, much appreciated.

Mike

Answer 2

Hi Mike,

Welcome to the Microsoft Q&A forum.

Based on the error code you provided, Error 399287 appears when the system detects unusual activity on your device that may pose a potential security risk to your tenant. As a result, the system may flag the phone number associated with the account as having a bad reputation in order to protect the tenant from potential threats.

In this situation, since you are the sole administrator of the tenant, you will need to contact Microsoft's Data Protection Team for assistance with identity verification and to review the security restrictions affecting your sign-in process.

Please look up the appropriate support hotline for your region and contact Microsoft's frontline support team. Then, request that they create a support ticket for you through the following link:

Contact Microsoft customer support | Microsoft Support

In this case, Microsoft's Data Protection Team is the only team with the specialized tools and procedures necessary to verify your identity and securely restore access to the administrator account.

Please note that moderators on the forum do not have the authority to directly intervene in user accounts, especially for issues related to:

• Account sign-in
• Password resets
• MFA authentication
• Changing or restoring access permissions

Tips for Navigating the IVR System (Automated Phone Support)

To help you navigate the IVR system more effectively, please refer to the guidance below:

1. When calling the support number, you may hear an introductory message for approximately 30 seconds (for example, "You can visit the link..."). You may skip this portion and wait until the system presents the available support options.
2. Then:
   • Press 1 as a business email user.
     • Press 1 again to select technical support.

In some regions, the initial interaction may be fully automated. Below is a sample dialogue you can prepare in advance:

• What kind of problem are you experiencing? Answer: Authenticator
• What products do you use? Answer: Office 365 for Business
• Is this for an education or company account? Answer: For companies
• Are you an administrator? Answer: Yes
• Are there any other administrators in your organization? Answer: No. I am the only admin in my tenant.
• Do you need a service request? Answer: Yes. I need to create a ticket. Please send me directly to the Data Protection Team.

During the call, you may be asked to provide subscription-related information such as:

• Company name
• Billing information
• Phone number
• Alternate email address

This information helps Microsoft's Data Protection Team verify your identity and securely assist you with restoring access to your tenant.

 I hope this information is helpful. Please follow these steps and let me know if it works for you. If not, we can work together to resolve this.   

Thank you for your patience and your understanding. If you have any questions or need further assistance, please feel free to share them in the comments on this post so I can continue to support you.

I look forward to continuing the conversation.

---

If the answer is helpful, please click "Yes". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.