Sole Global Administrator Locked Out After Incomplete Microsoft Authenticator Registration

Question

I am the sole Global Administrator of a Microsoft Entra tenant associated with examplecompany.com.

I recovered Global Administrator access through Microsoft’s “Get admin access” process by verifying domain ownership with a DNS TXT record.

During the first sign-in on my new mobile device as Work or School account, I was required to change my password due to first login on the new mobile device. I then attempted to add the work account to Microsoft Authenticator by entering the email and password instead of completing registration through a QR code.

Authenticator registration was not completed, but MFA was enforced and I was signed out.

The sign-in page now only asks:

“Enter the code displayed in the Microsoft Authenticator app.”

No alternative verification method (email, sms etc.) is available in this case, and the Authenticator app does not have a properly registered account capable of generating the required code.

I am the only accessible human Global Administrator, so I cannot reset my own MFA methods from the Entra portal.

I need Microsoft to reset the MFA registration, require re-registration, or issue a Temporary Access Pass so I can regain access and configure Microsoft Authenticator correctly.

Answer 1

Hi @Naeem Raza,

Based on the information you've shared, since you are the sole Global Administrator and are currently locked out due to an incomplete Microsoft Authenticator registration, the best next step is to contact Microsoft Support by phone so that the frontline support team can create a case and escalate it to the Data Protection team for further assistance.

You can find the appropriate support number for your region here: Contact Microsoft customer support | Microsoft Support

In this situation, the Microsoft Data Protection team has tools and processes in place to verify identity and regain access to administrator accounts.

To help you navigate the phone system more efficiently, here are a few tips:

(When you call the support number, you may hear an introduction of about 30 seconds such as "you can visit the link...". You can ignore this introduction and wait until you are presented with the options. Then press "1" as a business email user, and again "1" for technical help.)   

In some regions, the initial interaction may be automated, so here’s a general idea of how the conversation might go to help you prepare:     

• What kind of problem are you experiencing?        
• Answer: Authenticator        
• What products do you use?        
• Answer: Office 365 for business        
• Is this for an education or company account?        
• Answer: For companies        
• Are you an administrator?        
• Answer: Yes        
• Are there any other administrators in your organization?        
• Answer: No. I am the only admin in my tenant         
• Do you need a... Service request?         
• Answer: Yes. I need to create a ticket. Please send me direct to the Data Protection Teams.     

During the phone call, you will need to provide the information associated with your subscription, such as your company name, billing details, phone number, and an alternate email address, etc. This information allows the Data Protection team to verify your identity and securely assist you in regaining access to your administrator account.    

If calling support hasn’t been effective so far, there is a workaround you might consider. You can create a new Microsoft 365 tenant by signing up for a trial subscription here: Microsoft 365 Business Plans and Pricing | Microsoft 365 

Once the new tenant is set up, you’ll be able to access the Microsoft 365 admin center again, and from there you can submit a support ticket. In your request, clearly explain that you’ve been locked out of your original tenant as a sole admin due to losing your MFA method, and ask to be routed specifically to the Data Protection team. 

In many similar cases, this approach helps ensure your request is picked up by a real support engineer and properly routed, rather than getting stuck in automated flows or loops.  

One small but important note, once your original issue has been resolved, please remember to cancel the trial subscription to avoid any unintended charges.  

I truly hope this helps point you toward the right team and gets your access restored as quickly as possible. Thank you so much for your understanding.

---

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.  

Answer 2

To the best of my knowledge, the only viable path is to contact Microsoft 365 phone support to begin the recovery process.

https://learn.microsoft.com/en-us/microsoft-365/admin/get-help-support?view=o365-worldwide